34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T436,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample ad82b7bdc994… — Score 51/100 — Hybrid Analysis","description":"Malicious verdict for sample ad82b7bdc994…. Threat score 51/100. 0/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563"],"about":{"@type":"SoftwareApplication","name":"SD Prompt Reader CLI.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","additionalType":"Malicious sample"},"threatScore":51,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T22c0,Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:Te5e,"SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\certifi (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\charset_normalizer (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\fonts\Roboto (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\fonts (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\icons (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\themes (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\font\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\font (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\image\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\image (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\scaling\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\scaling (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\theme\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\theme (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\utility\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\utility (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets (UID: 00000000-00007844)38:T1dfc,"SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000df776953fd7f000080e6a92d0c02000060d4aa2d0c02000001000000fd7f000080e6a92d0c0200000000000000000000f4dd6453fd7f000000000000000000008041e52b0c0200002056a72d0c0200002056a72d0c020000ffffffffffffffff40a1be782b000000ffffffffffffffff20a1be782b000000e862bc53fd7f000019d76453fd7f00000800000000000000080000000000000078948853fd7f00004cf76953fd7f000008000000000000006fcf6453fd7f0000ffffffffffffffff303aa553fd7f0000906da22d0c020000906da22d0c0200000f87b77f934f000048556953fd7f0000e862bc53 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac557bfd7f0000000000000000000051ed437cfd7f0000000000000c02000000000000000000002425d7919e5b00002a00000000000000c06adb2b0c0200008fec437cfd7f0000e0ac557bfd7f0000e0ac557bfd7f0000000000000000000000000000fd7f0000ffffff7fb1ff000000000000000000000000000000000000d8ce497bfd7f00002a0000000000000069c3027bfd7f000031000000000000005c0200000000000060020000000000001100011000000000d079be782b00000003a3a979fd7f0000d079be782b00000000000000000000002b00000000000000000000000000000020b0087bfd7f0000b43f077bfd7f0000e0ce497b (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000ecfae164fd7f0000000000000000000000000000000000000000000000000000000000000000000064dfd7919e5b00000000000000000000000000000000000000000d53fd7f00000010000000000000000000000000000000000000000000000000000000000000ffffffffffffffff3883be782b0000004083be782b00000002000000000000005084be782b000000ffb62353fd7f00008582da41fe8d0000000000000000000000000000eb271c0000000000000400bc0100000000000000f1b72353fd7f000007000000000000000003fe7f000000000000000000000000c5402979fd7f00000003fe7f00000000c4b12353fd7f00000003fe7f (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000002000000000000000000000000000000403fbe782b0000000001000000000000f83dbe782b000000f0df332f0c020000000000000000e0c1f4dd6453fd7f00006941be782b000000c03ebe782b0000000000000000000000f0df332f0c0200006d41be782b0000000000000000000000d040be782b0000006841be782b000000010000000000000008e0332f0c0200000800000000000000080000000000000078948853fd7f00004cf76953fd7f000008000000000000006fcf6453fd7f0000ffffffffffffffff303aa553fd7f0000b0f1ee2e0c020000b0f1ee2e0c0200001f19b77f934f000048556953fd7f0000e862bc53 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000df776953fd7f0000208b372f0c0200008068eb2e0c02000001000000fd7f0000208b372f0c0200000000000000000000f4dd6453fd7f00000000000000000000b8948853fd7f00009086a62d0c0200009086a62d0c020000fffffffffffffffff010be782b000000ffffffffffffffffd010be782b000000e862bc53fd7f000019d76453fd7f00000800000000000000080000000000000078948853fd7f00004cf76953fd7f000008000000000000006fcf6453fd7f0000ffffffffffffffff303aa553fd7f00009067eb2e0c0200009067eb2e0c0200005f37b77f934f000048556953fd7f0000e862bc53 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000002000000000000000000000000000000c02cbe782b0000000001000000000000782bbe782b000000f0f7332f0c020000000000000000e0c1f4dd6453fd7f0000e92ebe782b000000402cbe782b0000000000000000000000f0f7332f0c020000ed2ebe782b0000000000000000000000502ebe782b000000e82ebe782b000000010000000000000008f8332f0c0200000800000000000000080000000000000078948853fd7f00004cf76953fd7f000008000000000000006fcf6453fd7f0000ffffffffffffffff303aa553fd7f0000506e352f0c020000506e352f0c0200009f0cb77f934f000048556953fd7f0000e862bc53 (UID: 00000000-00006896) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002584)39:T4b3,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "SD Prompt Reader CLI.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "SD Prompt Reader CLI.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "SD Prompt Reader CLI.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006896.00000000.216213.71335000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006896.00000000.216213.71335000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006896.00000000.216213.71335000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006896.00000000.216213.71335000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006896.00000000.216213.71335000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00006896.00000000.216213.71335000.00000002.mdmp")3a:Tfc1,"SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL" at 00000000-00007844-00000C15-2364444435 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL" at 00000000-00007844-00000C15-2364460505 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL" at 00000000-00007844-00000C15-2364514876 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL" at 00000000-00007844-00000C15-2364518786 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\certifi" at 00000000-00007844-00000C15-2364928986 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\charset_normalizer" at 00000000-00007844-00000C15-2364934995 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2364944650 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2364948767 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2364952959 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets" at 00000000-00007844-00000C15-2364953940 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2364957696 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets" at 00000000-00007844-00000C15-2364958544 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets\fonts" at 00000000-00007844-00000C15-2364959576 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2364991412 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets" at 00000000-00007844-00000C15-2364992236 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets\fonts" at 00000000-00007844-00000C15-2364993118 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets\fonts\Roboto" at 00000000-00007844-00000C15-2364993957 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2365011110 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets" at 00000000-00007844-00000C15-2365011923 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2365016835 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets" at 00000000-00007844-00000C15-2365017696 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets\icons" at 00000000-00007844-00000C15-2365018609 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-2365022774 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets" at 00000000-00007844-00000C15-2365023691 "SDPromptReaderCLI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter" at 00000000-00007844-00000C15-23650408353b:Tdbe,"SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\PIL (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\certifi (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\charset_normalizer (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\fonts (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\fonts\Roboto (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\icons (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\assets\themes (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\font (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\font\__pycache__ (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\image (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI78442\customtkinter\windows\widgets\image\__pycache__ (UID: 00000000-00007844)3c:T1fb4,"SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\ucrtbase.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-core-path-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-conio-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-filesystem-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-process-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-time-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\python311.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\python3 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter python3 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\DLLs\python3 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter libffi-8.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter python311.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_ctypes.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_bz2.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_lzma.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter api-ms-win-crt-utility-l1-1-0.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\pyexpat.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_socket.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\select.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_queue.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter libcrypto-1_1.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_hashlib.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter libssl-1_1.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_ssl.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter COMDLG32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter tcl86t.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter tk86t.dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\_tkinter.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter gdi32 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\PIL\_imaging.cp311-win_amd64.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\charset_normalizer\md.cp311-win_amd64.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\charset_normalizer\md__mypyc.cp311-win_amd64.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI78442\unicodedata.pyd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00006896) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002584) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002584) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002584) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002584)3d:T133ca,"SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RemoveVectoredExceptionHandler (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetHandleInformation (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetVolumePathNameW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetActiveProcessorCount (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GenerateConsoleCtrlEvent (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetThreadTimes (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetNumberOfConsoleInputEvents (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CancelIo (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter SetNamedPipeHandleState (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WaitNamedPipeA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter OpenFileMappingW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ReleaseSemaphore (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetSystemTimeAdjustment (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegFlushKey (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegSaveKeyW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegLoadKeyW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegConnectRegistryW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter RegSetValueW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PathCchSkipRoot (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PathCchCombineEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PathCchFindExtension (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _putwch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _ungetwch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _getwche (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _getche (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _getch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _ungetch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _putch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _getwch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter mbstowcs (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcstol (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strtoul (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcstombs (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter getenv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wputenv_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wgetcwd (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wgetenv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __p__wenviron (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wputenv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _umask (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wstat64i32 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _heapmin (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter localeconv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter setlocale (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter exp2 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter tanh (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter erfc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter sqrt (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter cbrt (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter cosh (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter erf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter pow (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter log10 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter frexp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fmod (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter floor (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter tan (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter atan (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter atan2 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _fdclass (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _dclass (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter nextafter (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter exp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fabs (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter acosh (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter log1p (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter log (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter acos (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter expm1 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _fdopen (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter atanh (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter asin (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter copysign (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ldexp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter hypot (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter asinh (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter modf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter sin (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter round (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter sinh (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter cos (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ceil (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wexecv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wspawnv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wexecve (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _cwait (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wspawnve (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __fpe_flt_rounds (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _getpid (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _initialize_narrow_environment (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _configure_narrow_argv (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _seh_filter_dll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _initterm_e (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _set_abort_behavior (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter raise (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _initialize_onexit_table (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _beginthreadex (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __sys_errlist (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __sys_nerr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _endthreadex (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wsystem (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _execute_onexit_table (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _set_thread_local_invalid_parameter_handler (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _open_osfhandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __stdio_common_vfprintf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __stdio_common_vswprintf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __stdio_common_vsprintf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _setmode (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter rewind (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __acrt_iob_func (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _commit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _locking (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wopen (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _kbhit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter getc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ungetc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _lseeki64 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ftell (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter feof (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fgets (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _get_osfhandle (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _chsize_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fputs (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _isatty (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _fileno (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _lseek (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _dup2 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ferror (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _close (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _open (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _read (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _dup (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _write (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter clearerr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter puts (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcsncmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcsnlen (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcsncpy_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter isalnum (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcscat_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter toupper (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strcspn (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcscoll (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter isxdigit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcstok_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcsxfrm (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter isdigit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcscpy_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __timezone (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _tzset (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strftime (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter clock (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _mktime64 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __daylight (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _gmtime64_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _localtime64_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcschr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter wcsrchr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __C_specific_handler (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_ExitStatusException (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_InitializeFromConfig (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyConfig_Clear (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyConfig_InitIsolatedConfig (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyConfig_Read (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyConfig_SetBytesString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyConfig_SetString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyConfig_SetWideStringList (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter DisableThreadLibraryCalls (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter iswctype (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_sint8 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_uint8 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_float (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_uint64 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_uint32 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_double (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_uint16 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_sint32 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_call (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_sint64 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_void (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_prep_cif (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_prep_closure (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_sint16 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ffi_type_pointer (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter ProgIDFromCLSID (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_LookupAttrId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_ValueError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _Py_CheckRecursiveCall (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_Next (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_Format (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_Type (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_AddType (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_IsSubtype (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_OverflowError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _Py_Dealloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLongMask (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyTuple_GetItem (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySequence_GetSlice (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDescr_NewGetSet (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_ExceptionMatches (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyUnicode_FromId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_AddObjectRef (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySequence_SetItem (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_ParseTuple_SizeT (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GetBuffer (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySys_Audit (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyList_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_Create2 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_Ready (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_NewException (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyDict_GetItemIdWithError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GenericSetAttr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_SetItem (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyLong_Sign (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_VectorcallMethod (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_IsInstance (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMem_Free (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_FromVoidPtr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_AsWideChar (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_NoMemory (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyRuntime (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsVoidPtr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_CallObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyIndex_Check (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyBytes_FromStringAndSize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_DelItem (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyNumber_AsSsize_t (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_MakeTpCall (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyWeakref_ProxyType (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_TypeError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyTuple_Pack (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyCallable_Check (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMem_Malloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_IndexError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyArg_UnpackTuple (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyBuffer_Release (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_Type (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySequence_Tuple (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyEval_RestoreThread (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_FromStringAndSize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_WarnEx (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_RuntimeWarning (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyOS_vsnprintf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GC_UnTrack (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyGILState_Release (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_WriteUnraisable (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_Initialize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GC_Del (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_Vectorcall (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFile_WriteString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GC_Track (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyGILState_Ensure (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_GC_NewVar (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMem_Calloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_SetObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_CallOneArg (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_SetString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyCapsule_IsValid (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyBytes_AsString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_AppendAndDel (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_BuildValue (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_SetFromWindowsErr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormatV (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFloat_FromDouble (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyTuple_Type (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_Free (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyCapsule_GetPointer (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_AsWideCharString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_GetAttrId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyThreadState_GetDict (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyCapsule_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_Type (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyTraceback_Add (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyUnicode_IsPrintable (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_OSError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMem_Realloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_FileNotFoundError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_Call (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyArg_ParseTuple (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyBool_FromLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_FromUnsignedLongLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFloat_AsDouble (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_FromLongLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_FromUnsignedLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLongLongMask (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFloat_Unpack4 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFloat_Pack4 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_IsTrue (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFloat_Pack8 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyByteArray_Type (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyFloat_Unpack8 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_GetAttr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySequence_Fast (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyTuple_Size (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyDict_SizeOf (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyLong_AsInt (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _Py_CheckFunctionResult (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyTuple_GetSlice (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_AttributeError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMemoryView_FromObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_SetItemString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyTuple_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyDict_ContainsId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _Py_NoneStruct (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_Contains (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_GetItemWithError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyDict_SetItemId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyErr_WriteUnraisableMsg (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyBuffer_IsContiguous (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_Concat (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySlice_Unpack (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_FromLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_RuntimeError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyEval_SaveThread (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8AndSize (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyWeakref_CallableProxyType (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyUnicode_EqualToASCIIString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_FromSsize_t (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyWeakref_NewProxy (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_Update (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySequence_GetItem (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySlice_Type (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsSsize_t (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_NoKeywords (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_GenericNew (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_SetAttrId (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_CallFunction_SizeT (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _Py_BuildValue_SizeT (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_Exception (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySlice_AdjustIndices (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDescr_NewClassMethod (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_InternFromString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_SetAttr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PySequence_Size (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter Py_GenericAlias (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_GetName (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_FromWideChar (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_IsSubclass (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_GetState (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_SystemError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_FromModuleAndSpec (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModuleDef_Init (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyThread_free_lock (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_EOFError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyNumber_Index (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyThread_release_lock (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_UnpackKeywords (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_BadArgument (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyThread_acquire_lock (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_NoPositional (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMem_RawMalloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyThread_allocate_lock (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_MemoryError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_SetNone (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_CheckPositional (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyErr_NewExceptionWithDoc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMapping_Check (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyType_GetModuleState (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyMapping_GetItemString (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_AddObject (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyArg_ParseTupleAndKeywords_SizeT (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyLong_AsUnsignedLongLong (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyExc_KeyError (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_AddIntConstant (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter rand_s (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyByteArray_empty_string (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _Py_HashSecret (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_Realloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyImport_SetModule (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyModule_AddStringConstant (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_GC_New (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter _PyObject_LookupAttr (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeUTF8 (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyObject_Malloc (UID: 00000000-00006896) "SDPromptReaderCLI.exe" called "GetProcAddress" with a parameter PyDict_SetDefault (UID: 00000000-00006896) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002584) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002584)3e:T8dd,Found GetProcAddress() and LoadLibraryA() in an import section (Source: python311.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-1_1.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: tcl86t.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: tk86t.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libssl-1_1.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libtkdnd2.9.3.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libffi-8.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imaging.cp311-win_amd64.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: unicodedata.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _webp.cp311-win_amd64.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _decimal.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imagingcms.cp311-win_amd64.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: pyexpat.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _lzma.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _ssl.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _ctypes.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _bz2.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _socket.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: md__mypyc.cp311-win_amd64.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _tkinter.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _hashlib.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: select.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _queue.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imagingmath.cp311-win_amd64.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _imagingtk.cp311-win_amd64.pyd)3f:T845,"python311.dll" contains export function called "PyAIter_Check" at ordinal 1 "python311.dll" contains export function called "PyArg_Parse" at ordinal 2 "python311.dll" contains export function called "PyArg_ParseTuple" at ordinal 3 "python311.dll" contains export function called "PyArg_ParseTupleAndKeywords" at ordinal 4 "python311.dll" contains export function called "PyArg_UnpackTuple" at ordinal 5 "python311.dll" contains export function called "PyArg_VaParse" at ordinal 6 "python311.dll" contains export function called "PyArg_VaParseTupleAndKeywords" at ordinal 7 "python311.dll" contains export function called "PyArg_ValidateKeywordArguments" at ordinal 8 "python311.dll" contains export function called "PyAsyncGen_New" at ordinal 9 "python311.dll" contains export function called "PyAsyncGen_Type" at ordinal 10 "python311.dll" contains export function called "PyBaseObject_Type" at ordinal 11 "python311.dll" contains export function called "PyBool_FromLong" at ordinal 12 "python311.dll" contains export function called "PyBool_Type" at ordinal 13 "python311.dll" contains export function called "PyBuffer_FillContiguousStrides" at ordinal 14 "python311.dll" contains export function called "PyBuffer_FillInfo" at ordinal 15 "python311.dll" contains export function called "PyBuffer_FromContiguous" at ordinal 16 "python311.dll" contains export function called "PyBuffer_GetPointer" at ordinal 17 "python311.dll" contains export function called "PyBuffer_IsContiguous" at ordinal 18 "python311.dll" contains export function called "PyBuffer_Release" at ordinal 19 "python311.dll" contains export function called "PyBuffer_SizeFromFormat" at ordinal 20 "python311.dll" contains export function called "PyBuffer_ToContiguous" at ordinal 21 "python311.dll" contains export function called "PyByteArrayIter_Type" at ordinal 22 "python311.dll" contains export function called "PyByteArray_AsString" at ordinal 23 "python311.dll" contains export function called "PyByteArray_Concat" at ordinal 24 "python311.dll" contains export function called "PyByteArray_FromObject" at ordinal 2540:T11ac,"SD Prompt Reader CLI.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "python311.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ucrtbase.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "tcl86t.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "tk86t.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libssl-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libtkdnd2.9.3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libffi-8.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-math-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-string-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-stdio-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-runtime-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-convert-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-core-file-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-core-localization-l1-2-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-core-processthreads-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-time-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-core-synch-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-filesystem-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-core-sysinfo-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-crt-process-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "api-ms-win-core-libraryloader-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA41:T192d,"SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 79230000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 79230000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 79230000 "SDPromptReaderCLI.exe" loaded module "KERNEL32" at base 79960000 "SDPromptReaderCLI.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 63cb0000 "SDPromptReaderCLI.exe" loaded module "RPCRT4.DLL" at base 79b10000 "SDPromptReaderCLI.exe" loaded module "NTDLL.DLL" at base 7c3f0000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 787b0000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\UCRTBASE.DLL" at base 71280000 "SDPromptReaderCLI.exe" loaded module "KERNEL32.DLL" at base 79960000 "SDPromptReaderCLI.exe" loaded module "ADVAPI32.DLL" at base 7aec0000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CORE-PATH-L1-1-0.DLL" at base 79230000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-CONIO-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-PROCESS-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "BCRYPT.DLL" at base 782a0000 "SDPromptReaderCLI.exe" loaded module "VCRUNTIME140.DLL" at base 71260000 "SDPromptReaderCLI.exe" loaded module "VERSION.DLL" at base 6f880000 "SDPromptReaderCLI.exe" loaded module "WS2_32.DLL" at base 7a2b0000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\PYTHON311.DLL" at base 53630000 "SDPromptReaderCLI.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 79060000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\PYTHON3" at base 0 "SDPromptReaderCLI.exe" loaded module "PYTHON3" at base 0 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\DLLS\PYTHON3" at base 0 "SDPromptReaderCLI.exe" loaded module "LIBFFI-8.DLL" at base 76bb0000 "SDPromptReaderCLI.exe" loaded module "OLE32.DLL" at base 79d00000 "SDPromptReaderCLI.exe" loaded module "OLEAUT32.DLL" at base 79c30000 "SDPromptReaderCLI.exe" loaded module "PYTHON311.DLL" at base 53630000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_CTYPES.PYD" at base 64780000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_BZ2.PYD" at base 64060000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_LZMA.PYD" at base 64030000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 78f60000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\PYEXPAT.PYD" at base 631f0000 "SDPromptReaderCLI.exe" loaded module "IPHLPAPI.DLL" at base 77d60000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_SOCKET.PYD" at base 63e20000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\SELECT.PYD" at base 71250000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_QUEUE.PYD" at base 65740000 "SDPromptReaderCLI.exe" loaded module "USER32.DLL" at base 7a770000 "SDPromptReaderCLI.exe" loaded module "LIBCRYPTO-1_1.DLL" at base 532b0000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_HASHLIB.PYD" at base 63930000 "SDPromptReaderCLI.exe" loaded module "CRYPT32.DLL" at base 796a0000 "SDPromptReaderCLI.exe" loaded module "LIBSSL-1_1.DLL" at base 63100000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_SSL.PYD" at base 631c0000 "SDPromptReaderCLI.exe" loaded module "NETAPI32.DLL" at base 6f890000 "SDPromptReaderCLI.exe" loaded module "USERENV.DLL" at base 78640000 "SDPromptReaderCLI.exe" loaded module "COMCTL32.DLL" at base 67160000 "SDPromptReaderCLI.exe" loaded module "COMDLG32.DLL" at base 7adb0000 "SDPromptReaderCLI.exe" loaded module "GDI32.DLL" at base 798d0000 "SDPromptReaderCLI.exe" loaded module "IMM32.DLL" at base 7a900000 "SDPromptReaderCLI.exe" loaded module "SHELL32.DLL" at base 7af70000 "SDPromptReaderCLI.exe" loaded module "TCL86T.DLL" at base 530d0000 "SDPromptReaderCLI.exe" loaded module "TK86T.DLL" at base 62f40000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\_TKINTER.PYD" at base 630e0000 "SDPromptReaderCLI.exe" loaded module "GDI32" at base 798d0000 "SDPromptReaderCLI.exe" loaded module "ADVAPI32" at base 7aec0000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\PIL\_IMAGING.CP311-WIN_AMD64.PYD" at base 4c480000 "SDPromptReaderCLI.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 77fd0000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\CHARSET_NORMALIZER\MD.CP311-WIN_AMD64.PYD" at base 65840000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\CHARSET_NORMALIZER\MD__MYPYC.CP311-WIN_AMD64.PYD" at base 651f0000 "SDPromptReaderCLI.exe" loaded module "%TEMP%\_MEI78442\UNICODEDATA.PYD" at base 59a70000 "SDPromptReaderCLI.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 79230000 "SDPromptReaderCLI.exe" loaded module "SHELL32" at base 7af70000 "cmd.exe" loaded module "KERNEL32" at base 79960000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 79230000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 79230000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 79230000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7a900000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 79230000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 79230000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 79230000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 63cb000042:T192d,"SD Prompt Reader CLI.exe" was detected as "PyInstaller" and name: "Packer" "SD Prompt Reader CLI.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "SD Prompt Reader CLI.exe" was detected as "Microsoft Linker" and name: "Linker" "python311.dll" was detected as "PyInstaller" and name: "Packer" "python311.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python311.dll" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-1_1.dll" was detected as "PyInstaller" and name: "Packer" "libcrypto-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "ucrtbase.dll" was detected as "PyInstaller" and name: "Packer" "ucrtbase.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ucrtbase.dll" was detected as "Microsoft Linker" and name: "Linker" "tcl86t.dll" was detected as "PyInstaller" and name: "Packer" "tcl86t.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tcl86t.dll" was detected as "Microsoft Linker" and name: "Linker" "tk86t.dll" was detected as "PyInstaller" and name: "Packer" "tk86t.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tk86t.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-1_1.dll" was detected as "PyInstaller" and name: "Packer" "libssl-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "libtkdnd2.9.3.dll" was detected as "PyInstaller" and name: "Packer" "libtkdnd2.9.3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libtkdnd2.9.3.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "PyInstaller" and name: "Packer" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "libffi-8.dll" was detected as "PyInstaller" and name: "Packer" "libffi-8.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libffi-8.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-math-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-string-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-file-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-localization-l1-2-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-localization-l1-2-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-localization-l1-2-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-time-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-synch-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-filesystem-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-filesystem-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-filesystem-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-process-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-libraryloader-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-core-libraryloader-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-libraryloader-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "PyInstaller" and name: "Packer" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker"43:T8d6,"SD Prompt Reader CLI.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ucrtbase.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libtkdnd2.9.3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-math-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-string-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-stdio-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-runtime-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-convert-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-file-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-localization-l1-2-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-processthreads-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-time-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-synch-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-filesystem-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-sysinfo-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-process-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-libraryloader-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-heap-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-conio-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-processenvironment-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-heap-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-console-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-rtlsupport-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-environment-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"44:T5c6,"SD Prompt Reader CLI.exe" has an executable section named ".text" "python311.dll" has an executable section named "UPX0" "python311.dll" has an executable section named "UPX1" "libcrypto-1_1.dll" has an executable section named "UPX0" "libcrypto-1_1.dll" has an executable section named "UPX1" "ucrtbase.dll" has an executable section named ".text" "tcl86t.dll" has an executable section named "UPX0" "tcl86t.dll" has an executable section named "UPX1" "tk86t.dll" has an executable section named "UPX0" "tk86t.dll" has an executable section named "UPX1" "libssl-1_1.dll" has an executable section named "UPX0" "libssl-1_1.dll" has an executable section named "UPX1" "libtkdnd2.9.3.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named ".text" "libtkdnd2.9.3.dll" has an executable section named "UPX0" "libtkdnd2.9.3.dll" has an executable section named "UPX1" "libffi-8.dll" has an executable section named "UPX0" "libffi-8.dll" has an executable section named "UPX1" "_imaging.cp311-win_amd64.pyd" has an executable section named "UPX0" "_imaging.cp311-win_amd64.pyd" has an executable section named "UPX1" "unicodedata.pyd" has an executable section named "UPX0" "unicodedata.pyd" has an executable section named "UPX1" "_webp.cp311-win_amd64.pyd" has an executable section named "UPX0" "_webp.cp311-win_amd64.pyd" has an executable section named "UPX1" "_decimal.pyd" has an executable section named "UPX0"45:T562,"SD Prompt Reader CLI.exe" has an writable section named ".data" "python311.dll" has an writable section named "UPX0" "python311.dll" has an writable section named "UPX1" "python311.dll" has an writable section named ".rsrc" "libcrypto-1_1.dll" has an writable section named "UPX0" "libcrypto-1_1.dll" has an writable section named "UPX1" "libcrypto-1_1.dll" has an writable section named ".rsrc" "ucrtbase.dll" has an writable section named ".data" "tcl86t.dll" has an writable section named "UPX0" "tcl86t.dll" has an writable section named "UPX1" "tcl86t.dll" has an writable section named ".rsrc" "tk86t.dll" has an writable section named "UPX0" "tk86t.dll" has an writable section named "UPX1" "tk86t.dll" has an writable section named ".rsrc" "libssl-1_1.dll" has an writable section named "UPX0" "libssl-1_1.dll" has an writable section named "UPX1" "libssl-1_1.dll" has an writable section named ".rsrc" "libtkdnd2.9.3.dll" has an writable section named ".data" "VCRUNTIME140.dll" has an writable section named ".data" "libtkdnd2.9.3.dll" has an writable section named "UPX0" "libtkdnd2.9.3.dll" has an writable section named "UPX1" "libtkdnd2.9.3.dll" has an writable section named ".rsrc" "libffi-8.dll" has an writable section named "UPX0" "libffi-8.dll" has an writable section named "UPX1" "libffi-8.dll" has an writable section named "UPX2"46:T2202,"SD Prompt Reader CLI.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000bc80,add rsp, 0x28,jmp 0x14000b88c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000c1e8,test eax, eax,je 0x14000ba5e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000ba51,cmp rcx, rax,je 0x14000ba65,xor eax, eax,lock cmpxchg qword ptr [rip + 0x34a6c], rcx,jne 0x14000ba4c,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000ba60,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "python311.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1805db2b1,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x18e6d3],lea rdi, [rsi - 0x44b000],push rdi,mov eax, 0x5d85f4,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x18e6ab,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "libcrypto-1_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x180353e21,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0xea243],lea rdi, [rsi - 0x268000],push rdi,mov eax, 0x351275,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0xea212,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "ucrtbase.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,cmp edx, 1,je 0x180015a58,mov r8, rdi,mov edx, ebx,mov rbx, qword ptr [rsp + 0x30],add rsp, 0x20,pop rdi,jmp 0x180015a68,call 0x180049c18,jmp 0x180015a44,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,xor esi, esi,test edx, edx,je 0x180015b8c,sub edx, 1,je 0x180015b31,sub edx, 1,jne 0x180015b09," "tcl86t.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1801ce531,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x9e953],lea rdi, [rsi - 0x12e000],push rdi,mov eax, 0x1cbfa0,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x9e92a,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "tk86t.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1801806c5,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x82af3],lea rdi, [rsi - 0xfc000],push rdi,mov eax, 0x17d500,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x82ac1,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "libssl-1_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1800b267b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x2aab3],lea rdi, [rsi - 0x86000],push rdi,mov eax, 0xafed7,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x2aa85,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "libtkdnd2.9.3.dll" file has an entrypoint instructions - "jg 0x8000657d,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x80006526,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,mov es, word ptr [eax],add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x800065cd,add edx, ebp," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000ffb1,call 0x1800103bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000ff18,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r10d, edx," "libtkdnd2.9.3.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18003422b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x12663],lea rdi, [rsi - 0x20000],push rdi,mov eax, 0x31c21,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x1263e,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "libffi-8.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18000da9b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x2ed3],lea rdi, [rsi - 0x9000],push rdi,mov eax, 0xa48c,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x2eaa,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300," "api-ms-win-crt-math-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-string-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-stdio-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-runtime-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-convert-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-file-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-localization-l1-2-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-processthreads-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-time-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-synch-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-filesystem-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-sysinfo-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-process-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-libraryloader-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al,"47:T5f9,"SD Prompt Reader CLI.exe" has high imagebase "0x140000000" "python311.dll" has high imagebase "0x180000000" "libcrypto-1_1.dll" has high imagebase "0x180000000" "ucrtbase.dll" has high imagebase "0x180000000" "tcl86t.dll" has high imagebase "0x180000000" "tk86t.dll" has high imagebase "0x180000000" "libssl-1_1.dll" has high imagebase "0x180000000" "libtkdnd2.9.3.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "libffi-8.dll" has high imagebase "0x180000000" "api-ms-win-crt-math-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-string-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-stdio-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-runtime-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-convert-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-file-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-localization-l1-2-0.dll" has high imagebase "0x180000000" "api-ms-win-core-processthreads-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-time-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-synch-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-filesystem-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-sysinfo-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-process-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-libraryloader-l1-1-0.dll" has high imagebase "0x180000000"48:T773,"SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")49:Tc23,"SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "SDPROMPTREADERCLI"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "")4a:Tea4,"SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\__init__.py" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\__pycache__\__init__.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\__pycache__\ctk_input_dialog.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\__pycache__\ctk_tk.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\__pycache__\ctk_toplevel.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\ctk_input_dialog.py" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\ctk_tk.py" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\ctk_toplevel.py" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__init__.py" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\__init__.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_button.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_checkbox.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_combobox.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_entry.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_frame.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_label.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_optionmenu.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_progressbar.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_radiobutton.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_scrollable_frame.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_scrollbar.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_segmented_button.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_slider.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_switch.cpython-311.pyc" "SDPromptReaderCLI.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\windows\widgets\__pycache__\ctk_tabview.cpython-311.pyc"4b:Tdd7,"SDPromptReaderCLI.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\VCRUNTIME140.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-DATETIME-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-DEBUG-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-FILE-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-FILE-L1-2-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-FILE-L2-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-HEAP-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-MEMORY-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-PROFILE-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-STRING-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-SYNCH-L1-1-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-SYNCH-L1-2-0.DLL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL"4c:Tc67,"SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_IMAGINGCMS.CP311-WIN_AMD64.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_IMAGINGMATH.CP311-WIN_AMD64.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_IMAGINGTK.CP311-WIN_AMD64.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_WEBP.CP311-WIN_AMD64.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_BZ2.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_CTYPES.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_DECIMAL.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_HASHLIB.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_LZMA.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_QUEUE.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_SOCKET.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_SSL.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_TKINTER.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_UUID.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\BASE_LIBRARY.ZIP" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\CERTIFI" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\certifi\PY.TYPED" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\CHARSET_NORMALIZER" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\charset_normalizer\MD__MYPYC.CP311-WIN_AMD64.PYD" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\CUSTOMTKINTER" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\__PYCACHE__" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\ASSETS" "SDPromptReaderCLI.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\customtkinter\assets\FONTS"4d:Tc01,"SDPromptReaderCLI.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-synch-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-sysinfo-l1-1-0.dll (UID: 00000000-00007844) "SDPromptReaderCLI.exe" called "FindNextFileW" with parameter api-ms-win-core-timezone-l1-1-0.dll (UID: 00000000-00007844)4e:Td8d,file/memory contains long string with (Indicator: ""; File: "ctk_button.py") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "ctk_switch.py") file/memory contains long string with (Indicator: ""; File: "ctk_checkbox.py") file/memory contains long string with (Indicator: ""; File: "clrpick.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "ctk_combobox.py") file/memory contains long string with (Indicator: ""; File: "ctk_radiobutton.py") file/memory contains long string with (Indicator: ""; File: "ctk_optionmenu.py") file/memory contains long string with (Indicator: ""; File: "ctk_slider.py") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "ctk_scrollbar.py") file/memory contains long string with (Indicator: ""; File: "scrlbar.tcl") file/memory contains long string with (Indicator: ""; File: "combobox.tcl") file/memory contains long string with (Indicator: ""; File: "combobox.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "scale.tcl") file/memory contains long string with (Indicator: ""; File: "menubutton.tcl") file/memory contains long string with (Indicator: ""; File: "notebook.tcl") file/memory contains long string with (Indicator: ""; File: "notebook.tcl") file/memory contains long string with (Indicator: ""; File: "tearoff.tcl") file/memory contains long string with (Indicator: ""; File: "focus.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "panedwindow.tcl")4f:Tb48,"SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SDPROMPTREADERCLI.EXE"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "SDPromptReaderCLI.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")50:T1216,"python311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\python311.dll]- [targetUID: 00000000-00006896] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\libcrypto-1_1.dll]- [targetUID: 00000000-00006896] "ucrtbase.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\ucrtbase.dll]- [targetUID: 00000000-00006896] "tcl86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\tcl86t.dll]- [targetUID: 00000000-00006896] "tk86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\tk86t.dll]- [targetUID: 00000000-00006896] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\libssl-1_1.dll]- [targetUID: 00000000-00006896] "libtkdnd2.9.3.dll" has type "PE32+ executable (DLL) (GUI) Aarch64 for MS Windows"- Location: [%TEMP%\_MEI78442\tkinterdnd2\tkdnd\win-arm64\libtkdnd2.9.3.dll]- [targetUID: 00000000-00007844] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\VCRUNTIME140.dll]- [targetUID: 00000000-00006896] "libtkdnd2.9.3.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\tkinterdnd2\tkdnd\win-x64\libtkdnd2.9.3.dll]- [targetUID: 00000000-00007844] "libffi-8.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\libffi-8.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00006896]51:T86f,"api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-localization-l1-2-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-filesystem-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-libraryloader-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-conio-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-processenvironment-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-heap-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-console-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-rtlsupport-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-environment-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-locale-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-processthreads-l1-1-1.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-memory-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-core-timezone-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"52:T4a7,"python311.dll" has a section named "UPX0" "python311.dll" has a section named "UPX1" "libcrypto-1_1.dll" has a section named "UPX0" "libcrypto-1_1.dll" has a section named "UPX1" "tcl86t.dll" has a section named "UPX0" "tcl86t.dll" has a section named "UPX1" "tk86t.dll" has a section named "UPX0" "tk86t.dll" has a section named "UPX1" "libssl-1_1.dll" has a section named "UPX0" "libssl-1_1.dll" has a section named "UPX1" "libtkdnd2.9.3.dll" has a section named "UPX0" "libtkdnd2.9.3.dll" has a section named "UPX1" "libffi-8.dll" has a section named "UPX0" "libffi-8.dll" has a section named "UPX1" "libffi-8.dll" has a section named "UPX2" "_imaging.cp311-win_amd64.pyd" has a section named "UPX0" "_imaging.cp311-win_amd64.pyd" has a section named "UPX1" "unicodedata.pyd" has a section named "UPX0" "unicodedata.pyd" has a section named "UPX1" "_webp.cp311-win_amd64.pyd" has a section named "UPX0" "_webp.cp311-win_amd64.pyd" has a section named "UPX1" "_decimal.pyd" has a section named "UPX0" "_decimal.pyd" has a section named "UPX1" "_imagingcms.cp311-win_amd64.pyd" has a section named "UPX0" "_imagingcms.cp311-win_amd64.pyd" has a section named "UPX1"53:T821,Dropped file "%TEMP%\_MEI78442\python311.dll" has high entropy 7.9934590902520855 Dropped file "%TEMP%\_MEI78442\libcrypto-1_1.dll" has high entropy 7.937981090630823 Dropped file "%TEMP%\_MEI78442\tcl86t.dll" has high entropy 7.986415369712437 Dropped file "%TEMP%\_MEI78442\tk86t.dll" has high entropy 7.748620745722713 Dropped file "%TEMP%\_MEI78442\libssl-1_1.dll" has high entropy 7.926132864121351 Dropped file "%TEMP%\_MEI78442\tkinterdnd2\tkdnd\win-x64\libtkdnd2.9.3.dll" has high entropy 7.955959152345361 Dropped file "%TEMP%\_MEI78442\libffi-8.dll" has high entropy 7.670317021417428 Dropped file "%TEMP%\_MEI78442\PIL\_imaging.cp311-win_amd64.pyd" has high entropy 7.998297088846991 Dropped file "%TEMP%\_MEI78442\unicodedata.pyd" has high entropy 7.98688922390057 Dropped file "%TEMP%\_MEI78442\PIL\_webp.cp311-win_amd64.pyd" has high entropy 7.984159848813236 Dropped file "%TEMP%\_MEI78442\_decimal.pyd" has high entropy 7.930848222236121 Dropped file "%TEMP%\_MEI78442\PIL\_imagingcms.cp311-win_amd64.pyd" has high entropy 7.959632607740676 Dropped file "%TEMP%\_MEI78442\pyexpat.pyd" has high entropy 7.910936089277236 Dropped file "%TEMP%\_MEI78442\_lzma.pyd" has high entropy 7.918447446063214 Dropped file "%TEMP%\_MEI78442\_ssl.pyd" has high entropy 7.851939220147247 Dropped file "%TEMP%\_MEI78442\_ctypes.pyd" has high entropy 7.8306382308329265 Dropped file "%TEMP%\_MEI78442\_bz2.pyd" has high entropy 7.811685518896749 Dropped file "%TEMP%\_MEI78442\_socket.pyd" has high entropy 7.708408420489188 Dropped file "%TEMP%\_MEI78442\charset_normalizer\md__mypyc.cp311-win_amd64.pyd" has high entropy 7.82504961634559 Dropped file "%TEMP%\_MEI78442\_tkinter.pyd" has high entropy 7.634860738941358 Dropped file "%TEMP%\_MEI78442\_hashlib.pyd" has high entropy 7.690223822010552 Dropped file "%TEMP%\_MEI78442\select.pyd" has high entropy 7.437676229168955 Dropped file "%TEMP%\_MEI78442\_queue.pyd" has high entropy 7.483231498841419 Dropped file "%TEMP%\_MEI78442\PIL\_imagingmath.cp311-win_amd64.pyd" has high entropy 7.18539788947108154:T744,"SD Prompt Reader CLI.exe" has resource with unusual entropy "RT_ICON:7.97041069466" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.29663311216" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.34698952451" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.24681175512" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.2887452565" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.29054771287" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.25754512509" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.30962012515" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.25860170938" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.40071759752" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.32570654866" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.28597008452" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.28001163334" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.34858116411" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.29013960567" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.31035247089" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.25934758146" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.37496329729" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.34591941389" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.34506012004" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.31374656686" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.44099802595" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.32783324357" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.35348303101" "tk86t.dll" has resource with unusual entropy "RT_CURSOR:7.33187581662"55:T4e53,"python311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\python311.dll]- [targetUID: 00000000-00006896] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\libcrypto-1_1.dll]- [targetUID: 00000000-00006896] "ucrtbase.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\ucrtbase.dll]- [targetUID: 00000000-00006896] "tcl86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\tcl86t.dll]- [targetUID: 00000000-00006896] "tk86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\tk86t.dll]- [targetUID: 00000000-00006896] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\libssl-1_1.dll]- [targetUID: 00000000-00006896] "libtkdnd2.9.3.dll" has type "PE32+ executable (DLL) (GUI) Aarch64 for MS Windows"- Location: [%TEMP%\_MEI78442\tkinterdnd2\tkdnd\win-arm64\libtkdnd2.9.3.dll]- [targetUID: 00000000-00007844] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\VCRUNTIME140.dll]- [targetUID: 00000000-00006896] "libtkdnd2.9.3.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\tkinterdnd2\tkdnd\win-x64\libtkdnd2.9.3.dll]- [targetUID: 00000000-00007844] "libffi-8.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\libffi-8.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00006896] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00006896] "_imaging.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\PIL\_imaging.cp311-win_amd64.pyd]- [targetUID: 00000000-00006896] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\unicodedata.pyd]- [targetUID: 00000000-00006896] "_webp.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\PIL\_webp.cp311-win_amd64.pyd]- [targetUID: 00000000-00007844] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_decimal.pyd]- [targetUID: 00000000-00006896] "_imagingcms.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\PIL\_imagingcms.cp311-win_amd64.pyd]- [targetUID: 00000000-00007844] "draw_engine.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering\draw_engine.py]- [targetUID: 00000000-00007844] "pyexpat.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\pyexpat.pyd]- [targetUID: 00000000-00006896] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_lzma.pyd]- [targetUID: 00000000-00006896] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_ssl.pyd]- [targetUID: 00000000-00006896] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_ctypes.pyd]- [targetUID: 00000000-00006896] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_bz2.pyd]- [targetUID: 00000000-00006896] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_socket.pyd]- [targetUID: 00000000-00006896] "md__mypyc.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\charset_normalizer\md__mypyc.cp311-win_amd64.pyd]- [targetUID: 00000000-00006896] "_tkinter.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_tkinter.pyd]- [targetUID: 00000000-00006896] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_hashlib.pyd]- [targetUID: 00000000-00006896] "ctk_button.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_button.py]- [targetUID: 00000000-00007844] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\select.pyd]- [targetUID: 00000000-00006896] "_queue.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_queue.pyd]- [targetUID: 00000000-00006896] "_uuid.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\_uuid.pyd]- [targetUID: 00000000-00006896] "ctk_textbox.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_textbox.py]- [targetUID: 00000000-00007844] "ctk_switch.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_switch.py]- [targetUID: 00000000-00007844] "ctk_checkbox.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_checkbox.py]- [targetUID: 00000000-00007844] "ctk_tabview.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_tabview.py]- [targetUID: 00000000-00007844] "ctk_segmented_button.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_segmented_button.py]- [targetUID: 00000000-00007844] "ctk_combobox.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_combobox.py]- [targetUID: 00000000-00007844] "ctk_radiobutton.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_radiobutton.py]- [targetUID: 00000000-00007844] "ctk_optionmenu.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_optionmenu.py]- [targetUID: 00000000-00007844] "ctk_slider.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_slider.py]- [targetUID: 00000000-00007844] "ctk_entry.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_entry.py]- [targetUID: 00000000-00007844] "ctk_base_class.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes\ctk_base_class.py]- [targetUID: 00000000-00007844] "ctk_tk.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\ctk_tk.py]- [targetUID: 00000000-00007844] "ctk_scrollable_frame.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_scrollable_frame.py]- [targetUID: 00000000-00007844] "ctk_toplevel.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\ctk_toplevel.py]- [targetUID: 00000000-00007844] "ctk_progressbar.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_progressbar.py]- [targetUID: 00000000-00007844] "ctk_scrollbar.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_scrollbar.py]- [targetUID: 00000000-00007844] "ctk_label.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_label.py]- [targetUID: 00000000-00007844] "_imagingmath.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\PIL\_imagingmath.cp311-win_amd64.pyd]- [targetUID: 00000000-00007844] "_imagingtk.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\PIL\_imagingtk.cp311-win_amd64.pyd]- [targetUID: 00000000-00007844] "md.cp311-win_amd64.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%TEMP%\_MEI78442\charset_normalizer\md.cp311-win_amd64.pyd]- [targetUID: 00000000-00006896] "ctk_frame.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\ctk_frame.py]- [targetUID: 00000000-00007844] "scaling_tracker.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\scaling\scaling_tracker.py]- [targetUID: 00000000-00007844] "dropdown_menu.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes\dropdown_menu.py]- [targetUID: 00000000-00007844] "scaling_base_class.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\scaling\scaling_base_class.py]- [targetUID: 00000000-00007844] "ctk_input_dialog.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\ctk_input_dialog.py]- [targetUID: 00000000-00007844] "ctk_canvas.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering\ctk_canvas.py]- [targetUID: 00000000-00007844] "ctk_image.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\image\ctk_image.py]- [targetUID: 00000000-00007844] "ctk_font.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\font\ctk_font.py]- [targetUID: 00000000-00007844] "appearance_mode_tracker.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode\appearance_mode_tracker.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\__init__.py]- [targetUID: 00000000-00007844] "appearance_mode_base_class.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode\appearance_mode_base_class.py]- [targetUID: 00000000-00007844] "font_manager.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\font\font_manager.py]- [targetUID: 00000000-00007844] "theme_manager.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\theme\theme_manager.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\font\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\theme\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\core_rendering\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\scaling\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\appearance_mode\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\core_widget_classes\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\utility\__init__.py]- [targetUID: 00000000-00007844] "__init__.py" has type "Python script ASCII text executable"- Location: [%TEMP%\_MEI78442\customtkinter\windows\widgets\image\__init__.py]- [targetUID: 00000000-00007844]56:T59b6,"SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_imaging.cp311-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_imagingcms.cp311-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_imagingmath.cp311-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_imagingtk.cp311-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\PIL\_webp.cp311-win_amd64.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_tkinter.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\_uuid.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-console-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-datetime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-debug-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-errorhandling-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-file-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-file-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-file-l2-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-handle-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-interlocked-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-libraryloader-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-localization-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-memory-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-namedpipe-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-processenvironment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-processthreads-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-processthreads-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-profile-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-rtlsupport-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-synch-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-synch-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-sysinfo-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-timezone-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-util-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-conio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-convert-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-environment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-filesystem-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-locale-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-math-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-process-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-runtime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-stdio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-time-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SDPromptReaderCLI.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-crt-utility-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...57:Ta56,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-cn.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-11.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macTurkish.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macRomania.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-13.enc" which has been seen in the context of ransomware (Indicator: .ENC)58:Tcb4,"SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-console-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-datetime-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-debug-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-errorhandling-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-file-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-file-l1-2-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-file-l2-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-handle-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-heap-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-interlocked-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-libraryloader-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-localization-l1-2-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-memory-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-namedpipe-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-processenvironment-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-processthreads-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-processthreads-l1-1-1.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-profile-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-rtlsupport-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-string-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-synch-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-synch-l1-2-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-sysinfo-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-timezone-l1-1-0.dll" for deletion "SDPromptReaderCLI.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI78442\api-ms-win-core-util-l1-1-0.dll" for deletion59:T823,"python311.dll" claimed CRC 0 while the actual is CRC 18146872 "ucrtbase.dll" claimed CRC 1072695 while the actual is CRC 1146335 "libtkdnd2.9.3.dll" claimed CRC 166303 while the actual is CRC 256588 "VCRUNTIME140.dll" claimed CRC 144807 while the actual is CRC 166303 "api-ms-win-crt-math-l1-1-0.dll" claimed CRC 57528 while the actual is CRC 46870 "api-ms-win-crt-string-l1-1-0.dll" claimed CRC 65750 while the actual is CRC 57528 "api-ms-win-crt-stdio-l1-1-0.dll" claimed CRC 81470 while the actual is CRC 65750 "api-ms-win-crt-runtime-l1-1-0.dll" claimed CRC 64953 while the actual is CRC 81470 "api-ms-win-crt-convert-l1-1-0.dll" claimed CRC 70091 while the actual is CRC 64953 "api-ms-win-core-file-l1-1-0.dll" claimed CRC 28156 while the actual is CRC 70091 "api-ms-win-core-localization-l1-2-0.dll" claimed CRC 65534 while the actual is CRC 28156 "api-ms-win-core-processthreads-l1-1-0.dll" claimed CRC 62297 while the actual is CRC 65534 "api-ms-win-crt-time-l1-1-0.dll" claimed CRC 63846 while the actual is CRC 62297 "api-ms-win-core-synch-l1-1-0.dll" claimed CRC 35123 while the actual is CRC 63846 "api-ms-win-crt-filesystem-l1-1-0.dll" claimed CRC 14887 while the actual is CRC 35123 "api-ms-win-core-sysinfo-l1-1-0.dll" claimed CRC 44825 while the actual is CRC 14887 "api-ms-win-crt-process-l1-1-0.dll" claimed CRC 58600 while the actual is CRC 44825 "api-ms-win-core-libraryloader-l1-1-0.dll" claimed CRC 66267 while the actual is CRC 58600 "api-ms-win-crt-heap-l1-1-0.dll" claimed CRC 27876 while the actual is CRC 66267 "api-ms-win-crt-conio-l1-1-0.dll" claimed CRC 73580 while the actual is CRC 27876 "api-ms-win-core-processenvironment-l1-1-0.dll" claimed CRC 57672 while the actual is CRC 73580 "api-ms-win-core-heap-l1-1-0.dll" claimed CRC 71381 while the actual is CRC 57672 "api-ms-win-core-console-l1-1-0.dll" claimed CRC 39830 while the actual is CRC 71381 "api-ms-win-core-rtlsupport-l1-1-0.dll" claimed CRC 24799 while the actual is CRC 39830 "api-ms-win-crt-environment-l1-1-0.dll" claimed CRC 48456 while the actual is CRC 247995a:T572,"python311.dll" has an entrypoint in section "UPX1" "libcrypto-1_1.dll" has an entrypoint in section "UPX1" "tcl86t.dll" has an entrypoint in section "UPX1" "tk86t.dll" has an entrypoint in section "UPX1" "libssl-1_1.dll" has an entrypoint in section "UPX1" "libtkdnd2.9.3.dll" has an entrypoint in section "UPX1" "libffi-8.dll" has an entrypoint in section "UPX1" "_imaging.cp311-win_amd64.pyd" has an entrypoint in section "UPX1" "unicodedata.pyd" has an entrypoint in section "UPX1" "_webp.cp311-win_amd64.pyd" has an entrypoint in section "UPX1" "_decimal.pyd" has an entrypoint in section "UPX1" "_imagingcms.cp311-win_amd64.pyd" has an entrypoint in section "UPX1" "pyexpat.pyd" has an entrypoint in section "UPX1" "_lzma.pyd" has an entrypoint in section "UPX1" "_ssl.pyd" has an entrypoint in section "UPX1" "_ctypes.pyd" has an entrypoint in section "UPX1" "_bz2.pyd" has an entrypoint in section "UPX1" "_socket.pyd" has an entrypoint in section "UPX1" "md__mypyc.cp311-win_amd64.pyd" has an entrypoint in section "UPX1" "_tkinter.pyd" has an entrypoint in section "UPX1" "_hashlib.pyd" has an entrypoint in section "UPX1" "select.pyd" has an entrypoint in section "UPX1" "_queue.pyd" has an entrypoint in section "UPX1" "_imagingmath.cp311-win_amd64.pyd" has an entrypoint in section "UPX1" "_imagingtk.cp311-win_amd64.pyd" has an entrypoint in section "UPX1"5b:T84c,"ucrtbase.dll" claims program is from Sat Sep 30 12:04:00 1989 "VCRUNTIME140.dll" claims program is from Sat Sep 30 01:19:01 2045 "api-ms-win-crt-math-l1-1-0.dll" claims program is from Fri Jul 24 11:22:23 1981 "api-ms-win-crt-string-l1-1-0.dll" claims program is from Sat Sep 17 19:16:52 2067 "api-ms-win-crt-stdio-l1-1-0.dll" claims program is from Fri Sep 2 20:12:46 2033 "api-ms-win-crt-runtime-l1-1-0.dll" claims program is from Wed Oct 18 20:19:39 2034 "api-ms-win-crt-convert-l1-1-0.dll" claims program is from Mon Feb 10 22:53:18 1975 "api-ms-win-core-localization-l1-2-0.dll" claims program is from Thu Jun 21 10:44:07 2040 "api-ms-win-core-processthreads-l1-1-0.dll" claims program is from Sat Sep 25 11:46:28 2088 "api-ms-win-crt-time-l1-1-0.dll" claims program is from Wed Nov 25 12:44:53 2105 "api-ms-win-core-synch-l1-1-0.dll" claims program is from Thu Jan 6 09:12:46 2078 "api-ms-win-crt-filesystem-l1-1-0.dll" claims program is from Sat Jan 2 12:42:25 2055 "api-ms-win-core-sysinfo-l1-1-0.dll" claims program is from Tue Aug 14 09:03:47 2085 "api-ms-win-crt-process-l1-1-0.dll" claims program is from Mon Oct 27 06:36:10 2059 "api-ms-win-core-libraryloader-l1-1-0.dll" claims program is from Thu Jun 17 19:26:21 1993 "api-ms-win-crt-heap-l1-1-0.dll" claims program is from Fri Feb 22 21:12:37 2075 "api-ms-win-crt-conio-l1-1-0.dll" claims program is from Sun Dec 11 13:02:21 2078 "api-ms-win-core-processenvironment-l1-1-0.dll" claims program is from Fri Nov 12 00:31:37 2038 "api-ms-win-core-heap-l1-1-0.dll" claims program is from Wed Mar 12 12:33:21 2104 "api-ms-win-core-console-l1-1-0.dll" claims program is from Mon Oct 23 03:31:10 2102 "api-ms-win-core-rtlsupport-l1-1-0.dll" claims program is from Fri Aug 29 16:37:20 2087 "api-ms-win-crt-environment-l1-1-0.dll" claims program is from Sun Oct 13 12:54:12 2075 "api-ms-win-core-processthreads-l1-1-1.dll" claims program is from Mon Jun 7 02:00:36 2055 "api-ms-win-core-memory-l1-1-0.dll" claims program is from Sat Oct 9 11:49:00 1971 "api-ms-win-core-timezone-l1-1-0.dll" claims program is from Sun Jun 7 20:03:42 20265c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHcAAAAAAAAAAAAAAAAAAACIgAAAAAAAAAAAAAAAAAcH+PgAAAAAAAAAAAAAAAB4iIiHcAAAAAAAAAAAAAAHiIiId3cAAAAAAAAAAAAAB3eId3d3AAAAAAAAAAAAAAf4d3dweHAAAAAAAAAAAAB/h3d3cHd3AAAAAAAAAAB3iHd3d3B3dwcAAAAAAAAHiId3d3cAB4d3cAAAAAAAB3h3d3cAAH93d3AAAAB3AAd3d3d3cAf3B3d3AAcAh3AHh3cIiIcH8Hh3cAB/AAiAf/cHeP93d3CP/3AIgAAP+H9wCP+Hd3cHiIiHf/AAAP+PcAj/cHd3AI+I//8AAAAA+PcI9wf//3j4/48AAAAAAAD/eIcHiI+P/4gAAAAAAAAAD//4B4+I/4jwAAAAAAAAAAAIj3j/j/jwAAAAAAAAAAAAAA////iAAAAAAAAAAAAAAAAAD4iAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":51,"unified_at_epoch_ms":1793969335999,"unified_at":"2026-11-06T12:48:55.999Z","metadata":{"hashes":{"sha256":"ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","sha1":"ae3f24222bba18efcd62a939a1c79284addef567","md5":"d6f18bdd9e0e962989f95b79bff2cc50","sha512":"5ed2b7c649950a9f3341274b0d70465fb41d4df839ce03109e58d7358aa76ab7846e3138f5af279ab8ab220cb71b9238e67ff82a67db301ce3df21654267c1ab","ssdeep":"393216:Ktyu0EKYBRznlPSa77QyaynW81LWI8z9THk+xQ:Kj0NaznlxvQynW8ArtN","ssdeep_chunks":["393216:Ktyu0EK","393216:tyu0EKY","393216:yu0EKYB","393216:u0EKYBR","393216:0EKYBRz","393216:EKYBRzn","393216:KYBRznl","393216:YBRznlP","393216:BRznlPS","393216:RznlPSa","393216:znlPSa7","393216:nlPSa77","393216:lPSa77Q","393216:PSa77Qy","393216:Sa77Qya","393216:a77Qyay","393216:77Qyayn","393216:7QyaynW","393216:QyaynW8","393216:yaynW81","393216:aynW81L","393216:ynW81LW","393216:nW81LWI","393216:W81LWI8","393216:81LWI8z","393216:1LWI8z9","393216:LWI8z9T","393216:WI8z9TH","393216:I8z9THk","393216:8z9THk+","393216:z9THk+x","393216:9THk+xQ","786432:Ktyu0EK","786432:tyu0EKY","786432:yu0EKYB","786432:u0EKYBR","786432:0EKYBRz","786432:EKYBRzn","786432:KYBRznl","786432:YBRznlP","786432:BRznlPS","786432:RznlPSa","786432:znlPSa7","786432:nlPSa77","786432:lPSa77Q","786432:PSa77Qy","786432:Sa77Qya","786432:a77Qyay","786432:77Qyayn","786432:7QyaynW","786432:QyaynW8","786432:yaynW81","786432:aynW81L","786432:ynW81LW","786432:nW81LWI","786432:W81LWI8","786432:81LWI8z","786432:1LWI8z9","786432:LWI8z9T","786432:WI8z9TH","786432:I8z9THk","786432:8z9THk+","786432:z9THk+x","786432:9THk+xQ","393216:Kj0Nazn","393216:j0Naznl","393216:0Naznlx","393216:Naznlxv","393216:aznlxvQ","393216:znlxvQy","393216:nlxvQyn","393216:lxvQynW","393216:xvQynW8","393216:vQynW8A","393216:QynW8Ar","393216:ynW8Art","393216:nW8ArtN"],"imphash":"52ae61962d789433a613a2012a6cee3b"},"file_info":{"file_name":"SD Prompt Reader CLI.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":18103888,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1716752561000,"last_seen":1789626087000,"last_multi_scan":1789626087000},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":51,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":130,"suspicious_count":18,"malicious_count":1,"total":149},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to enumerate files/folders on disk"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"},{"type":"suspicious","value":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"Failed to get address for Tcl_CreateThread\n\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"$0<.xn\", Heuristic match: \"30.la\", Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\", Heuristic match: \"%s%c%s.py\", Heuristic match: \"30.cr\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.5.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"Failed to get address for Tcl_CreateThread\n\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Y%Oid\" (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"$37","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"Failed to get address for Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")\n Found reference to API \"Failed to get address for Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00006896.00000000.216213.53C0C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"msgbox.tcl\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"fontchooser.tcl\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"scale.tcl\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"SDPromptReaderCLI.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007844)\n \"SDPromptReaderCLI.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"SDPromptReaderCLI.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"SDPromptReaderCLI.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"init.tcl\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"auto.tcl\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"iconlist.tcl\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"comdlg.tcl\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"fonts.tcl\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"word.tcl\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00006896-00000C41-28796156260","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"api-ms-win-core-rtlsupport-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"Py_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006896.00000000.216213.53C0C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"SDPromptReaderCLI.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"SDPromptReaderCLI.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SDPromptReaderCLI.exe\"\" - (UID: 00000000-00007844)\n \"SDPromptReaderCLI.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"SDPromptReaderCLI.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006896-00000C41-28796156260\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006896-00000C41-28796156260\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3f","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:6896:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6896:304:WilStaging_02\"\n \"SM0:6896:304:WilStaging_02\"\n \"Local\\SM0:6896:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"SDPromptReaderCLI.exe\" failed to load missing module \"%TEMP%\\_MEI78442\\python3\" - [base:0; Status:c0000135]\n \"SDPromptReaderCLI.exe\" failed to load missing module \"python3\" - [base:0; Status:c0000135]\n \"SDPromptReaderCLI.exe\" failed to load missing module \"%TEMP%\\_MEI78442\\DLLs\\python3\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$40","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"from .theme_manager import ThemeManager# load default blue themetry: ThemeManager.load_theme(\"blue\")except FileNotFoundError as err: raise FileNotFoundError(f\"{err}\\nThe .json theme file for CustomTkinter could not be found.\\n\" + f\"If packaging with pyinstaller was used\n have a look at the wiki:\\n\" + f\"https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe\")\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"SDPromptReaderCLI.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 79060000\n \"SDPromptReaderCLI.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 782A0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 79060000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"SDPromptReaderCLI.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 79B10000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 79B10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$43","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$44","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$45","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$46","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x18f600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x44b000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x190000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x268000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x12e000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x18b000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$47","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00006896-00000BC0-2388424023]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00006896-00000C41-28796156260]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"SDPromptReaderCLI.exe\" (UID: 00000000-00006896) was launched with new environment variables: \"_MEIPASS2=\"%TEMP%\\_MEI78442\"\"\n Process \"cmd.exe\" (UID: 00000000-00002584) was launched with new environment variables: \"TCL_LIBRARY=\"%TEMP%\\_MEI78442\\tcl\", TK_LIBRARY=\"%TEMP%\\_MEI78442\\tk\"\"\n Process \"cmd.exe\" (UID: 00000000-00002584) was launched with missing environment variables: \"_MEIPASS2\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"SDPromptReaderCLI.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"SDPromptReaderCLI.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"SDPromptReaderCLI.exe\" (UID: 00000000-00006896)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00002584)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"SDPromptReaderCLI.exe\" (UID: 00000000-00006896)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00002584)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"SDPromptReaderCLI.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI78442\\PIL\\_imaging.cp311-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"SDPromptReaderCLI.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI78442\\PIL\\_imaging.cp311-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"SDPromptReaderCLI.exe\" queries basic process information of the \"C:\\SDPromptReaderCLI.exe\" (UID: 7844)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"SDPromptReaderCLI.exe\" reads file \"c:\\sdpromptreadercli.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"SDPromptReaderCLI.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"SDPromptReaderCLI.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\ole32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"SDPromptReaderCLI.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei78442\\pil\\_imaging.cp311-win_amd64.pyd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"SD Prompt Reader CLI.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"__author__ = \"receyuki\"__filename__ = \"__init__.py\"__copyright__ = \"Copyright 2023\"__email__ = \"receyuki@gmail.com\"\" (Indicator: \"@gmail.\"; File: \"__init__.py\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"btcl\\msgs\\es_mx.msg\" [Source: 00000000-00006896.00000000.216213.2BD90000.00000004.mdmp]\n Observed email domain:\"btcl\\msgs\\es_mx.msg\" [Source: 00000000-00007844.00000000.215394.47130000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetDCName\" which can \"Returns the name of the primary domain controller (PDC).\" [Source: tcl86t.dll]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"SDPromptReaderCLI.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"mkpsenc.tcl\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"bgerror.tcl\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Hobart\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Macquarie\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Broken_Hill\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Melbourne\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Sydney\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Lord_Howe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Lindeman\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"Brisbane\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"SD Prompt Reader CLI.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"NetGetDCName\" (Indicator: \"GetDC\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"SD Prompt Reader CLI.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"SD Prompt Reader CLI.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007844.00000000.215394.5AAFB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"# TLS secrets log file, generated by OpenSSL / Python\" (Indicator: \"secret\"; File: \"sslkey.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: SD Prompt Reader CLI.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: ucrtbase.dll]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: libtkdnd2.9.3.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\SDPromptReaderCLI.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006896.00000000.216213.2BD90000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\SDPromptReaderCLI.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007844.00000000.215394.47130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006896.00000000.216213.71335000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SDPromptReaderCLI.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\SDPROMPTREADERCLI.EXE\"; Value: \"^`q\")\n \"SDPromptReaderCLI.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CD959FAADFAFDA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: SD Prompt Reader CLI.exe]\n Observed import api \"EqualSid\" which can \"Tests two security identifier (SID) values for equality\" [Source: tcl86t.dll]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$51","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n UPX1\n UPX1\n UPX1\n UPX1 with unusual entropies 7.99977936894\n 7.99971331689\n 7.99932944256\n 7.9989475435\n 7.99644210493","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"$52","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; File: \"SD Prompt Reader CLI.exe\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; Source: \"00000000-00006896.00000000.216213.53C0C000.00000004.mdmp\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00006896.00000000.216213.53C0C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$53","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"SDPromptReaderCLI.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007844)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"receyuki@gmail.com\"\n Pattern match: \"c@8.u\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$54","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"SDPromptReaderCLI.exe\" writes archive file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI78442\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$56","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$57","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2377 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$58","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"SDPromptReaderCLI.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\SDPROMPTREADERCLI.EXE\"; Value: \"^`q\")\n \"SDPromptReaderCLI.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CD959FAADFAFDA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$59","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"$5a","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n GetDriveTypeW\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetFileSizeEx\n FindNextFileW\n FindFirstFileExW\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n CreateProcessW\n Sleep\n GetWindowThreadProcessId\n VirtualProtect\n LoadLibraryA\n OutputDebugStringW\n GetLogicalDrives\n VirtualAlloc\n CreateThread\n ExitThread\n GetSystemInfo\n RegCloseKey","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"$5b","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SDPromptReaderCLI.exe\" wrote 00000FB8 bytes to a remote process \"C:\\SDPromptReaderCLI.exe\" (Handle: 316)\n \"SDPromptReaderCLI.exe\" wrote 00000008 bytes to a remote process \"C:\\SDPromptReaderCLI.exe\" (Handle: 316)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]}],"intel_graph":{"map":{"File:058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1":{"type":"File","value":"058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1"},"File:0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d":{"type":"File","value":"0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d"},"File:1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6":{"type":"File","value":"1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6"},"File:1e9af4a96c3c91795eb5826b386db4889bf438bab259188035fc64e7cdd29bf4":{"type":"File","value":"1e9af4a96c3c91795eb5826b386db4889bf438bab259188035fc64e7cdd29bf4"},"File:1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c":{"type":"File","value":"1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c"},"File:26f5c394e69c8472ab097f50d3cefc0a47be22379173debacb3d8ae66a3c447b":{"type":"File","value":"26f5c394e69c8472ab097f50d3cefc0a47be22379173debacb3d8ae66a3c447b"},"File:2c3c465e1dd3f0b79035eab46595c16932990b3440a05ef8bec1c0916e752858":{"type":"File","value":"2c3c465e1dd3f0b79035eab46595c16932990b3440a05ef8bec1c0916e752858"},"File:2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e":{"type":"File","value":"2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e"},"File:35534ba57bbca8d023d6f63fa15018b0bc1260c4cdfa68eebc141759db9ae13c":{"type":"File","value":"35534ba57bbca8d023d6f63fa15018b0bc1260c4cdfa68eebc141759db9ae13c"},"File:3946cfecb0b794f557a804a8e06064dfa07f26ba2fbb5f2bd17d4db6d91f1d5d":{"type":"File","value":"3946cfecb0b794f557a804a8e06064dfa07f26ba2fbb5f2bd17d4db6d91f1d5d"},"File:3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65":{"type":"File","value":"3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65"},"File:3aff414299a60b6376036e59b28ae15eed5be07a81dbe65e97b25e810462c237":{"type":"File","value":"3aff414299a60b6376036e59b28ae15eed5be07a81dbe65e97b25e810462c237"},"File:415527c677e84f0d6121073a8a1589f3c9c2d1827732a9c725423f05e2f69eb5":{"type":"File","value":"415527c677e84f0d6121073a8a1589f3c9c2d1827732a9c725423f05e2f69eb5"},"File:46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819":{"type":"File","value":"46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819"},"File:4c520f598356bcd4f39b0954a41351da9fd75e17c96de7a86f4ea2a1db6aaaa6":{"type":"File","value":"4c520f598356bcd4f39b0954a41351da9fd75e17c96de7a86f4ea2a1db6aaaa6"},"File:550a0e226db764a60ff3c559410005ee7d2974092144cfac5c027552df9ab13e":{"type":"File","value":"550a0e226db764a60ff3c559410005ee7d2974092144cfac5c027552df9ab13e"},"File:58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9":{"type":"File","value":"58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9"},"File:5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9":{"type":"File","value":"5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9"},"File:5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639":{"type":"File","value":"5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639"},"File:5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd":{"type":"File","value":"5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd"},"File:5ec4c0d13752b861721390effaea5cbbea2ca393248cda71cf6df1ba1661f4b1":{"type":"File","value":"5ec4c0d13752b861721390effaea5cbbea2ca393248cda71cf6df1ba1661f4b1"},"File:609efae60195e6d6709408c344df8f1fb207b7d394e7121e1cf6380a1d93e606":{"type":"File","value":"609efae60195e6d6709408c344df8f1fb207b7d394e7121e1cf6380a1d93e606"},"File:6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232":{"type":"File","value":"6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232"},"File:629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086":{"type":"File","value":"629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086"},"File:668b77ad9c498625435816d70bf44fda8427750100fd776cf58b26461477c540":{"type":"File","value":"668b77ad9c498625435816d70bf44fda8427750100fd776cf58b26461477c540"},"File:7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86":{"type":"File","value":"7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86"},"File:72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a":{"type":"File","value":"72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a"},"File:76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e":{"type":"File","value":"76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e"},"File:76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644":{"type":"File","value":"76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644"},"File:7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92":{"type":"File","value":"7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92"},"File:8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2":{"type":"File","value":"8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2"},"File:8a027e8255dfc7d35e884e14e789ce65a37a0935a20bcf35c0d2b00a74473f5c":{"type":"File","value":"8a027e8255dfc7d35e884e14e789ce65a37a0935a20bcf35c0d2b00a74473f5c"},"File:8a1753b4fcbe0f3ac87b9f1bf4bdaac2d26fbdf26fc2d2e2cdc72b9444d0a867":{"type":"File","value":"8a1753b4fcbe0f3ac87b9f1bf4bdaac2d26fbdf26fc2d2e2cdc72b9444d0a867"},"File:8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0":{"type":"File","value":"8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0"},"File:8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da":{"type":"File","value":"8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da"},"File:8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f":{"type":"File","value":"8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f"},"File:913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd":{"type":"File","value":"913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd"},"File:91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014":{"type":"File","value":"91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014"},"File:9f012750c5e08b2dc11c343ec501071cc3dae1448ad5c8934a58de6f51e9661d":{"type":"File","value":"9f012750c5e08b2dc11c343ec501071cc3dae1448ad5c8934a58de6f51e9661d"},"File:a4da7638babf25a513227f681333716fdc84606ebc39dc8b2929a8690a00d9c4":{"type":"File","value":"a4da7638babf25a513227f681333716fdc84606ebc39dc8b2929a8690a00d9c4"},"File:a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3":{"type":"File","value":"a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3"},"File:a7529dfdc5c30c8f6c7ca0867f4711ed4488a83478a53b0a3ca41809ce5fdf08":{"type":"File","value":"a7529dfdc5c30c8f6c7ca0867f4711ed4488a83478a53b0a3ca41809ce5fdf08"},"File:a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0":{"type":"File","value":"a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0"},"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563":{"type":"File","value":"ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563"},"File:b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34":{"type":"File","value":"b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34"},"File:b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0":{"type":"File","value":"b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0"},"File:b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607":{"type":"File","value":"b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607"},"File:c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3":{"type":"File","value":"c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3"},"File:c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29":{"type":"File","value":"c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29"},"File:cc06086078367b733342f638dd488eaea5dc5b0ed2957e47421a6d3ecf0a8b15":{"type":"File","value":"cc06086078367b733342f638dd488eaea5dc5b0ed2957e47421a6d3ecf0a8b15"},"File:d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045":{"type":"File","value":"d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045"},"File:d713adc2454abe95b57eff3600c819c8737cf2c20d426928e1c8b528f663fed3":{"type":"File","value":"d713adc2454abe95b57eff3600c819c8737cf2c20d426928e1c8b528f663fed3"},"File:d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198":{"type":"File","value":"d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198"},"File:dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf":{"type":"File","value":"dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf"},"File:dc9ae185033520e220042f603bd9211bc245261233a79180a809e383e90f0747":{"type":"File","value":"dc9ae185033520e220042f603bd9211bc245261233a79180a809e383e90f0747"},"File:dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1":{"type":"File","value":"dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1"},"File:e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887":{"type":"File","value":"e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887"},"File:e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf":{"type":"File","value":"e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf"},"File:f249bf13a85ac94ab74b7ae9681ce1e6c2a85ec681dd8ffbaf71e0cb96ee1ba7":{"type":"File","value":"f249bf13a85ac94ab74b7ae9681ce1e6c2a85ec681dd8ffbaf71e0cb96ee1ba7"},"File:f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e":{"type":"File","value":"f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e"},"File:f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91":{"type":"File","value":"f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91"},"File:f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e":{"type":"File","value":"f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e"},"File:f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f":{"type":"File","value":"f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f"},"File:f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb":{"type":"File","value":"f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb"}},"chains":[{"id":"sandbox_files","root":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","edges":[{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:dc9ae185033520e220042f603bd9211bc245261233a79180a809e383e90f0747"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:668b77ad9c498625435816d70bf44fda8427750100fd776cf58b26461477c540"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:a7529dfdc5c30c8f6c7ca0867f4711ed4488a83478a53b0a3ca41809ce5fdf08"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:9f012750c5e08b2dc11c343ec501071cc3dae1448ad5c8934a58de6f51e9661d"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:609efae60195e6d6709408c344df8f1fb207b7d394e7121e1cf6380a1d93e606"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:8a1753b4fcbe0f3ac87b9f1bf4bdaac2d26fbdf26fc2d2e2cdc72b9444d0a867"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:8a027e8255dfc7d35e884e14e789ce65a37a0935a20bcf35c0d2b00a74473f5c"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:26f5c394e69c8472ab097f50d3cefc0a47be22379173debacb3d8ae66a3c447b"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:1e9af4a96c3c91795eb5826b386db4889bf438bab259188035fc64e7cdd29bf4"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:d713adc2454abe95b57eff3600c819c8737cf2c20d426928e1c8b528f663fed3"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:35534ba57bbca8d023d6f63fa15018b0bc1260c4cdfa68eebc141759db9ae13c"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:550a0e226db764a60ff3c559410005ee7d2974092144cfac5c027552df9ab13e"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:f249bf13a85ac94ab74b7ae9681ce1e6c2a85ec681dd8ffbaf71e0cb96ee1ba7"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:3946cfecb0b794f557a804a8e06064dfa07f26ba2fbb5f2bd17d4db6d91f1d5d"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:4c520f598356bcd4f39b0954a41351da9fd75e17c96de7a86f4ea2a1db6aaaa6"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:a4da7638babf25a513227f681333716fdc84606ebc39dc8b2929a8690a00d9c4"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:5ec4c0d13752b861721390effaea5cbbea2ca393248cda71cf6df1ba1661f4b1"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:3aff414299a60b6376036e59b28ae15eed5be07a81dbe65e97b25e810462c237"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:2c3c465e1dd3f0b79035eab46595c16932990b3440a05ef8bec1c0916e752858"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:415527c677e84f0d6121073a8a1589f3c9c2d1827732a9c725423f05e2f69eb5"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:cc06086078367b733342f638dd488eaea5dc5b0ed2957e47421a6d3ecf0a8b15"},{"edge_kind":"extracted","from_key":"File:ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","to_key":"File:6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":63,"files_written_count":237,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"665390af8eab17d6a507afe6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":51,"submit_name":"SD Prompt Reader CLI.exe","analysis_start_time":"2024-05-26T19:42:42+00:00","indicators_count":{"informative":125,"suspicious":38,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}],"processes":[{"pid":7844,"ppid":0,"name":"SDPromptReaderCLI.exe","command_line":"","sha256":"ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","normalized_path":"C:\\SDPromptReaderCLI.exe","uid":"00000000-00007844","icon":"$5c"},{"pid":6896,"ppid":7844,"name":"SDPromptReaderCLI.exe","command_line":"","sha256":"ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563","normalized_path":"C:\\SDPromptReaderCLI.exe","parent_uid":"00000000-00007844","uid":"00000000-00006896"},{"pid":2584,"ppid":6896,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006896","uid":"00000000-00002584"}],"all_imported_dlls":["kernel32.dll","advapi32.dll","rpcrt4.dll","ws2_32.dll","IPHLPAPI.DLL","msasn1.dll","mswsock.dll","KernelBase.dll","gdi32full.dll","VCRUNTIME140.dll","profapi.dll","comctl32.dll","gdi32.dll","msvcp_win.dll","ucrtbase.dll","imm32.dll","fltLib.dll","version.dll","shlwapi.dll","powrprof.dll","oleaut32.dll","libcrypto-1_1.dll","libssl-1_1.dll","SHCore.dll","cfgmgr32.dll","userenv.dll","logoncli.dll","samcli.dll","combase.dll","VxSSL64.dll","python311.dll","bcrypt.dll","shell32.dll","netapi32.dll","netutils.dll","win32u.dll","libffi-8.dll","msvcrt.dll","ole32.dll","tk86t.dll","windows.storage.dll","user32.dll","sechost.dll","bcryptprimitives.dll","kernel.appcore.dll","crypt32.dll","tcl86t.dll","comdlg32.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_imaging.cp311-win_amd64.pyd","sha256":"dc9ae185033520e220042f603bd9211bc245261233a79180a809e383e90f0747","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_imagingcms.cp311-win_amd64.pyd","sha256":"668b77ad9c498625435816d70bf44fda8427750100fd776cf58b26461477c540","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_imagingmath.cp311-win_amd64.pyd","sha256":"a7529dfdc5c30c8f6c7ca0867f4711ed4488a83478a53b0a3ca41809ce5fdf08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_imagingtk.cp311-win_amd64.pyd","sha256":"9f012750c5e08b2dc11c343ec501071cc3dae1448ad5c8934a58de6f51e9661d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_webp.cp311-win_amd64.pyd","sha256":"609efae60195e6d6709408c344df8f1fb207b7d394e7121e1cf6380a1d93e606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"VCRUNTIME140.dll","sha256":"76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_bz2.pyd","sha256":"8a1753b4fcbe0f3ac87b9f1bf4bdaac2d26fbdf26fc2d2e2cdc72b9444d0a867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_ctypes.pyd","sha256":"8a027e8255dfc7d35e884e14e789ce65a37a0935a20bcf35c0d2b00a74473f5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_decimal.pyd","sha256":"26f5c394e69c8472ab097f50d3cefc0a47be22379173debacb3d8ae66a3c447b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_hashlib.pyd","sha256":"1e9af4a96c3c91795eb5826b386db4889bf438bab259188035fc64e7cdd29bf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_lzma.pyd","sha256":"d713adc2454abe95b57eff3600c819c8737cf2c20d426928e1c8b528f663fed3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_queue.pyd","sha256":"35534ba57bbca8d023d6f63fa15018b0bc1260c4cdfa68eebc141759db9ae13c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_socket.pyd","sha256":"550a0e226db764a60ff3c559410005ee7d2974092144cfac5c027552df9ab13e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_ssl.pyd","sha256":"f249bf13a85ac94ab74b7ae9681ce1e6c2a85ec681dd8ffbaf71e0cb96ee1ba7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_tkinter.pyd","sha256":"3946cfecb0b794f557a804a8e06064dfa07f26ba2fbb5f2bd17d4db6d91f1d5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"_uuid.pyd","sha256":"8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"cacert.pem","sha256":"7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"libcrypto-1_1.dll","sha256":"4c520f598356bcd4f39b0954a41351da9fd75e17c96de7a86f4ea2a1db6aaaa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"libffi-8.dll","sha256":"a4da7638babf25a513227f681333716fdc84606ebc39dc8b2929a8690a00d9c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"libssl-1_1.dll","sha256":"5ec4c0d13752b861721390effaea5cbbea2ca393248cda71cf6df1ba1661f4b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"python311.dll","sha256":"3aff414299a60b6376036e59b28ae15eed5be07a81dbe65e97b25e810462c237","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"tcl86t.dll","sha256":"2c3c465e1dd3f0b79035eab46595c16932990b3440a05ef8bec1c0916e752858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"tk86t.dll","sha256":"415527c677e84f0d6121073a8a1589f3c9c2d1827732a9c725423f05e2f69eb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"libtkdnd2.9.3.dll","sha256":"cc06086078367b733342f638dd488eaea5dc5b0ed2957e47421a6d3ecf0a8b15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"ucrtbase.dll","sha256":"6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]}],"files_written":[{"path":"%TEMP%\\_MEI78442\\PIL\\_imaging.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\PIL\\_imagingcms.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\PIL\\_imagingmath.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\PIL\\_imagingtk.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\PIL\\_webp.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_tkinter.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\charset_normalizer\\md.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\charset_normalizer\\md__mypyc.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\.DS_Store","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\fonts\\CustomTkinter_shapes_font.otf","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\fonts\\Roboto\\Roboto-Medium.ttf","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\fonts\\Roboto\\Roboto-Regular.ttf","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\icons\\.DS_Store","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\icons\\CustomTkinter_icon_Windows.ico","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\themes\\blue.json","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\themes\\dark-blue.json","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\assets\\themes\\green.json","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\__pycache__\\ctk_input_dialog.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\__pycache__\\ctk_tk.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\__pycache__\\ctk_toplevel.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\ctk_input_dialog.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\ctk_tk.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\ctk_toplevel.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_button.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_checkbox.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_combobox.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_entry.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_frame.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_label.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_optionmenu.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_progressbar.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_radiobutton.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_scrollable_frame.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_scrollbar.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_segmented_button.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_slider.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_switch.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_tabview.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\__pycache__\\ctk_textbox.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\appearance_mode\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\appearance_mode\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\appearance_mode\\__pycache__\\appearance_mode_base_class.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\appearance_mode\\__pycache__\\appearance_mode_tracker.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\appearance_mode\\appearance_mode_base_class.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\appearance_mode\\appearance_mode_tracker.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_rendering\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_rendering\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_rendering\\__pycache__\\ctk_canvas.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_rendering\\__pycache__\\draw_engine.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_rendering\\ctk_canvas.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_rendering\\draw_engine.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_widget_classes\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_widget_classes\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_widget_classes\\__pycache__\\ctk_base_class.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_widget_classes\\__pycache__\\dropdown_menu.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_widget_classes\\ctk_base_class.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\core_widget_classes\\dropdown_menu.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_button.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_checkbox.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_combobox.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_entry.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_frame.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_label.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_optionmenu.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_progressbar.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_radiobutton.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_scrollable_frame.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_scrollbar.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_segmented_button.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_slider.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_switch.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_tabview.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\ctk_textbox.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\font\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\font\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\font\\__pycache__\\ctk_font.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\font\\__pycache__\\font_manager.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\font\\ctk_font.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\font\\font_manager.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\image\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\image\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\image\\__pycache__\\ctk_image.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\image\\ctk_image.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\scaling\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\scaling\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\scaling\\__pycache__\\scaling_base_class.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\scaling\\__pycache__\\scaling_tracker.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\scaling\\scaling_base_class.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\scaling\\scaling_tracker.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\theme\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\theme\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\theme\\__pycache__\\theme_manager.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\theme\\theme_manager.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\utility\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\utility\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\utility\\__pycache__\\utility_functions.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\customtkinter\\windows\\widgets\\utility\\utility_functions.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\python311.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\__init__.py","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\__pycache__\\__init__.cpython-311.pyc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\check_circle_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\check_circle_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\cleaning_services_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\cleaning_services_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\content_copy_20.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\content_copy_20_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\content_copy_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\content_copy_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\description_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\description_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\edit_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\edit_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\edit_off_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\edit_off_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\error_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\error_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\expand_more_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\expand_more_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\gray.json","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\icon-cli.ico","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\icon-cube.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\icon-gui.ico","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\icon.icns","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\icon.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\info_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\info_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\lightbulb_20.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\lightbulb_20_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\mop_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\mop_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\place_item_48.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\place_item_48_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\save_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\save_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\sort_by_alpha_20.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\sort_by_alpha_20_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\update_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\update_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\view_sidebar_20.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\view_sidebar_20_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\view_week_20.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\view_week_20_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\warning_24.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\sd_prompt_reader\\resources\\warning_24_alpha.png","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\select.pyd","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl86t.dll","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl8\\8.4\\platform-1.0.18.tm","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl8\\8.4\\platform\\shell-1.1.4.tm","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl8\\8.5\\msgcat-1.6.1.tm","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl8\\8.5\\tcltest-2.5.3.tm","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl8\\8.6\\http-2.9.5.tm","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cns11643.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\_MEI78442\\tcl\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]},{"name":"Local\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665390af8eab17d6a507afe6"}]}]}},"report_ids":{"sandbox_job_ids":["665390af8eab17d6a507afe6"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample ad82b7bdc994… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ad82b7bdc994…. Threat score 51/100. 0/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample ad82b7bdc994… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ad82b7bdc994…. Threat score 51/100. 0/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ad82b7bdc994eff6dd36820de25e18cd2f5ede3be002d43c88881a483e857563"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample ad82b7bdc994… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ad82b7bdc994…. Threat score 51/100. 0/25 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]] 32:null