Edit tour

Windows Analysis Report
Notice Letter 2025 03 12 02930920.docs.exe

Overview

General Information

Sample name:	Notice Letter 2025 03 12 02930920.docs.exe
Analysis ID:	1637395
MD5:	f36c74bdf4d6a5cf72291eb97be7e611
SHA1:	9ca5426bd908436a8ca51f6ff50bff9f4d3af5de
SHA256:	1ee248f86ddf0bfb05150a132db11c337baa46fd619f64a7e1cb1885fab4d35c
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates processes with suspicious names

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Notice Letter 2025 03 12 02930920.docs.exe (PID: 6920 cmdline: "C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe" MD5: F36C74BDF4D6A5CF72291EB97BE7E611)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Notice Letter 2025 .exe (PID: 7136 cmdline: "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe" MD5: 573C3AA20CAB92C93663F0E475323557)

powershell.exe (PID: 6412 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3652 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

AddInProcess32.exe (PID: 4376 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cmd.exe (PID: 6968 cmdline: "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Notice Letter 2025 .exe (PID: 6308 cmdline: "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe" MD5: 573C3AA20CAB92C93663F0E475323557)

AddInProcess32.exe (PID: 6392 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cmd.exe (PID: 3628 cmdline: "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Notice Letter 2025 .exe (PID: 5676 cmdline: "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe" MD5: 573C3AA20CAB92C93663F0E475323557)

AddInProcess32.exe (PID: 6476 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

svchost.exe (PID: 2248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7037952909:AAF8yKTbb2R5m9F5ipKQv80Lyr7WJX4ll-I", "Telegram Chatid": "7062552884"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf078:$a1: get_encryptedPassword 0xf3a0:$a2: get_encryptedUsername 0xee13:$a3: get_timePasswordChanged 0xef34:$a4: get_passwordField 0xf08e:$a5: set_encryptedPassword 0x109df:$a7: get_logins 0x10690:$a8: GetOutlookPasswords 0x10482:$a9: StartKeylogger 0x1092f:$a10: KeyLoggerEventArgs 0x104df:$a11: KeyLoggerEventArgsEventHandler
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf078:$a1: get_encryptedPassword 0xf3a0:$a2: get_encryptedUsername 0xee13:$a3: get_timePasswordChanged 0xef34:$a4: get_passwordField 0xf08e:$a5: set_encryptedPassword 0x109df:$a7: get_logins 0x10690:$a8: GetOutlookPasswords 0x10482:$a9: StartKeylogger 0x1092f:$a10: KeyLoggerEventArgs 0x104df:$a11: KeyLoggerEventArgsEventHandler
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0d0:$a1: get_encryptedPassword 0x25b0f:$a1: get_encryptedPassword 0xf3f8:$a2: get_encryptedUsername 0x25e37:$a2: get_encryptedUsername 0xee6b:$a3: get_timePasswordChanged 0x258aa:$a3: get_timePasswordChanged 0xef8c:$a4: get_passwordField 0x259cb:$a4: get_passwordField 0xf0e6:$a5: set_encryptedPassword 0x25b25:$a5: set_encryptedPassword 0x10a37:$a7: get_logins 0x27476:$a7: get_logins 0x106e8:$a8: GetOutlookPasswords 0x27127:$a8: GetOutlookPasswords 0x104da:$a9: StartKeylogger 0x26f19:$a9: StartKeylogger 0x10987:$a10: KeyLoggerEventArgs 0x273c6:$a10: KeyLoggerEventArgs 0x10537:$a11: KeyLoggerEventArgsEventHandler 0x26f76:$a11: KeyLoggerEventArgsEventHandler
00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0b7:$a1: get_encryptedPassword 0xf3df:$a2: get_encryptedUsername 0xee52:$a3: get_timePasswordChanged 0xef73:$a4: get_passwordField 0xf0cd:$a5: set_encryptedPassword 0x10a1e:$a7: get_logins 0x106cf:$a8: GetOutlookPasswords 0x104c1:$a9: StartKeylogger 0x1096e:$a10: KeyLoggerEventArgs 0x1051e:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0b7:$a1: get_encryptedPassword 0xf3df:$a2: get_encryptedUsername 0xee52:$a3: get_timePasswordChanged 0xef73:$a4: get_passwordField 0xf0cd:$a5: set_encryptedPassword 0x10a1e:$a7: get_logins 0x106cf:$a8: GetOutlookPasswords 0x104c1:$a9: StartKeylogger 0x1096e:$a10: KeyLoggerEventArgs 0x1051e:$a11: KeyLoggerEventArgsEventHandler
00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe258:$a1: get_encryptedPassword 0x24c68:$a1: get_encryptedPassword 0xe580:$a2: get_encryptedUsername 0x24f90:$a2: get_encryptedUsername 0xdff3:$a3: get_timePasswordChanged 0x24a03:$a3: get_timePasswordChanged 0xe114:$a4: get_passwordField 0x24b24:$a4: get_passwordField 0xe26e:$a5: set_encryptedPassword 0x24c7e:$a5: set_encryptedPassword 0xfbbf:$a7: get_logins 0x265cf:$a7: get_logins 0xf870:$a8: GetOutlookPasswords 0x26280:$a8: GetOutlookPasswords 0xf662:$a9: StartKeylogger 0x26072:$a9: StartKeylogger 0xfb0f:$a10: KeyLoggerEventArgs 0x2651f:$a10: KeyLoggerEventArgs 0xf6bf:$a11: KeyLoggerEventArgsEventHandler 0x260cf:$a11: KeyLoggerEventArgsEventHandler
0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0d0:$a1: get_encryptedPassword 0x25b0f:$a1: get_encryptedPassword 0xf3f8:$a2: get_encryptedUsername 0x25e37:$a2: get_encryptedUsername 0xee6b:$a3: get_timePasswordChanged 0x258aa:$a3: get_timePasswordChanged 0xef8c:$a4: get_passwordField 0x259cb:$a4: get_passwordField 0xf0e6:$a5: set_encryptedPassword 0x25b25:$a5: set_encryptedPassword 0x10a37:$a7: get_logins 0x27476:$a7: get_logins 0x106e8:$a8: GetOutlookPasswords 0x27127:$a8: GetOutlookPasswords 0x104da:$a9: StartKeylogger 0x26f19:$a9: StartKeylogger 0x10987:$a10: KeyLoggerEventArgs 0x273c6:$a10: KeyLoggerEventArgs 0x10537:$a11: KeyLoggerEventArgsEventHandler 0x26f76:$a11: KeyLoggerEventArgsEventHandler
0000000F.00000002.2118827331.00000000033F6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0b7:$a1: get_encryptedPassword 0xf3df:$a2: get_encryptedUsername 0xee52:$a3: get_timePasswordChanged 0xef73:$a4: get_passwordField 0xf0cd:$a5: set_encryptedPassword 0x10a1e:$a7: get_logins 0x106cf:$a8: GetOutlookPasswords 0x104c1:$a9: StartKeylogger 0x1096e:$a10: KeyLoggerEventArgs 0x1051e:$a11: KeyLoggerEventArgsEventHandler
00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0d0:$a1: get_encryptedPassword 0x25b0f:$a1: get_encryptedPassword 0xf3f8:$a2: get_encryptedUsername 0x25e37:$a2: get_encryptedUsername 0xee6b:$a3: get_timePasswordChanged 0x258aa:$a3: get_timePasswordChanged 0xef8c:$a4: get_passwordField 0x259cb:$a4: get_passwordField 0xf0e6:$a5: set_encryptedPassword 0x25b25:$a5: set_encryptedPassword 0x10a37:$a7: get_logins 0x27476:$a7: get_logins 0x106e8:$a8: GetOutlookPasswords 0x27127:$a8: GetOutlookPasswords 0x104da:$a9: StartKeylogger 0x26f19:$a9: StartKeylogger 0x10987:$a10: KeyLoggerEventArgs 0x273c6:$a10: KeyLoggerEventArgs 0x10537:$a11: KeyLoggerEventArgsEventHandler 0x26f76:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xde6f:$a1: get_encryptedPassword 0xe197:$a2: get_encryptedUsername 0xdc0a:$a3: get_timePasswordChanged 0xdd2b:$a4: get_passwordField 0xde85:$a5: set_encryptedPassword 0xf7d6:$a7: get_logins 0xf487:$a8: GetOutlookPasswords 0xf279:$a9: StartKeylogger 0xf726:$a10: KeyLoggerEventArgs 0xf2d6:$a11: KeyLoggerEventArgsEventHandler
0000000A.00000002.2116559550.0000000002B86000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2117283137.0000000003086000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x110e3b3:$a1: get_encryptedPassword 0x110e6cc:$a2: get_encryptedUsername 0x110e162:$a3: get_timePasswordChanged 0x110e283:$a4: get_passwordField 0x110e3c9:$a5: set_encryptedPassword 0x110fcc1:$a7: get_logins 0x110f972:$a8: GetOutlookPasswords 0x110f764:$a9: StartKeylogger 0x110fc11:$a10: KeyLoggerEventArgs 0x110f7c1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Notice Letter 2025 .exe PID: 7136	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 7136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 7136	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 7136	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 7136	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe4498:$a1: get_encryptedPassword 0x1497f2:$a1: get_encryptedPassword 0xe47b1:$a2: get_encryptedUsername 0x149b0b:$a2: get_encryptedUsername 0xe4247:$a3: get_timePasswordChanged 0x1495a1:$a3: get_timePasswordChanged 0xe4368:$a4: get_passwordField 0x1496c2:$a4: get_passwordField 0xe44ae:$a5: set_encryptedPassword 0x149808:$a5: set_encryptedPassword 0xe5da6:$a7: get_logins 0x14b100:$a7: get_logins 0xe5a57:$a8: GetOutlookPasswords 0x14adb1:$a8: GetOutlookPasswords 0xe5849:$a9: StartKeylogger 0x14aba3:$a9: StartKeylogger 0xe5cf6:$a10: KeyLoggerEventArgs 0x14b050:$a10: KeyLoggerEventArgs 0xe58a6:$a11: KeyLoggerEventArgsEventHandler 0x14ac00:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: AddInProcess32.exe PID: 4376	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4376	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4376	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4376	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33c3b:$a1: get_encryptedPassword 0x33f54:$a2: get_encryptedUsername 0x339ea:$a3: get_timePasswordChanged 0x33b0b:$a4: get_passwordField 0x33c51:$a5: set_encryptedPassword 0x35549:$a7: get_logins 0x351fa:$a8: GetOutlookPasswords 0x34fec:$a9: StartKeylogger 0x35499:$a10: KeyLoggerEventArgs 0x35049:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Notice Letter 2025 .exe PID: 6308	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 6308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 6308	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 6308	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Notice Letter 2025 .exe PID: 6308	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x7fc15:$a1: get_encryptedPassword 0x7ff2e:$a2: get_encryptedUsername 0x7f9c4:$a3: get_timePasswordChanged 0x7fae5:$a4: get_passwordField 0x7fc2b:$a5: set_encryptedPassword 0x81523:$a7: get_logins 0x811d4:$a8: GetOutlookPasswords 0x80fc6:$a9: StartKeylogger 0x81473:$a10: KeyLoggerEventArgs 0x81023:$a11: KeyLoggerEventArgsEventHandler
Click to see the 59 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe", ParentImage: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe, ParentProcessId: 7136, ParentProcessName: Notice Letter 2025 .exe, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", ProcessId: 6412, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: cmd.exe /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe, ProcessId: 7136, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Notice Letter 2025

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe", CommandLine: "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe", CommandLine|base64offset|contains: -mz, Image: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe, NewProcessName: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe, ParentCommandLine: "C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe", ParentImage: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe, ParentProcessId: 6920, ParentProcessName: Notice Letter 2025 03 12 02930920.docs.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe", ProcessId: 7136, ProcessName: Notice Letter 2025 .exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe", ParentImage: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe, ParentProcessId: 7136, ParentProcessName: Notice Letter 2025 .exe, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", ProcessId: 6412, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2248, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T15:46:52.525527+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49681	193.122.6.168	80	TCP
2025-03-13T15:47:03.275628+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49683	193.122.6.168	80	TCP
2025-03-13T15:47:10.275538+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49690	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000A.00000002.2116559550.0000000002A61000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7037952909:AAF8yKTbb2R5m9F5ipKQv80Lyr7WJX4ll-I", "Telegram Chatid": "7062552884"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\msvcp290.dll	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vstdlib_s64.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\SystemRootDoc\msvcp290.dll	ReversingLabs: Detection: 13%
Source: C:\Users\user\SystemRootDoc\vstdlib_s64.dll	ReversingLabs: Detection: 15%

Multi AV Scanner detection for submitted file

Source: Notice Letter 2025 03 12 02930920.docs.exe

Virustotal: Detection: 12%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49682 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49684 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49691 version: TLS 1.0

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\buildworker\steam_rel_client_win64\build\src\steamerrorreporter\win64\Release\steamerrorreporter64.pdb source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000000.872328581.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880796330.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000009.00000000.980236760.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983113344.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pkg.d7c6a10fb0263a69b4596321\node\out\Release\node.pdb source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF687349000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pkg.d7c6a10fb0263a69b4596321\node\out\Release\node.pdb) source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF687349000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\buildworker\steam_rel_client_win64\build\src\steamerrorreporter\win64\Release\steamerrorreporter64.pdb1 source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000000.872328581.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880796330.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000009.00000000.980236760.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983113344.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\buildworker\steam_rel_client_win64\build\src\tier0\win64\Release\tier0_s64.pdb source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.882926560.00007FFBFA235000.00000002.00000001.01000000.00000006.sdmp, Notice Letter 2025 .exe, 00000009.00000002.984188825.00007FFBFA915000.00000002.00000001.01000000.0000000E.sdmp

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49683 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49690 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49681 -> 193.122.6.168:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49682 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49684 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49691 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000002F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://narwhaljs.org)
Source: powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Notice Letter 2025 .exe, 00000002.00000002.884157344.00007FFBFA9B1000.00000004.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.884157344.00007FFBFA9B1000.00000004.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp, powershell.exe, 00000003.00000002.914940107.000001BE00001000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.884157344.00007FFBFA9B1000.00000004.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871339405.0000020AD7343000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.864912430.0000020AD6F95000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.884157344.00007FFBFA9B1000.00000004.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.882328583.00007FFBFA183000.00000008.00000001.01000000.00000007.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983440509.00007FFBFA0D3000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000003.00000002.914940107.000001BE00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10704
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#table
Source: powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000000.872328581.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880796330.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000009.00000000.980236760.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983113344.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://crash.steampowered.com/submitFailed
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/v8/7848
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/antirez/linenoise
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/chalk/supports-color
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://github.com/dotnet/reactive
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://github.com/graphql-dotnet/graphql-client
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/isaacs/color-support.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/pump
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.865997105.000000F9CD901000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.855153760.0000020ACBA7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/1a96d83a223ff9f05f7d942fb84440d323f7b596/lib/internal/bootstrap/
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/31074
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.865997105.000000F9CD901000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866396270.0000020ACBA86000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.855153760.0000020ACBA7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33229
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.865997105.000000F9CD901000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866396270.0000020ACBA86000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.855153760.0000020ACBA7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vercel/pkg/issues/1589
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/t5IS6M).
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://jimmy.warting.se/opensource
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://no-color.org/
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nodejs.org/
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v16.16.0/node-v16.16.0-headers.tar.gz
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v16.16.0/node-v16.16.0.tar.gz
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nodejs.org/download/release/v16.16.0/node-v16.16.0.tar.gzhttps://nodejs.org/download/release
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v16.16.0/win-x64/node.lib
Source: powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sourcemaps.info/spec.html
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/proposal-iterator-helpers/#sec-iteratorprototype.some
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Notice Letter 2025 03 12 02930920.docs.exe

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesteamerrorreporter.exe, vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametier0_s.dll\ vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOcudayehaF vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871339405.0000020AD7343000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEjoxawojinewugL vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametier0_s.dll\ vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametier0_s.dll\ vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.852167086.00007FF687B1B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEyakowe.exe@ vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOcudayehaF vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.864912430.0000020AD6F95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEjoxawojinewugL vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesteamerrorreporter.exe, vs Notice Letter 2025 03 12 02930920.docs.exe
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametier0_s.dll\ vs Notice Letter 2025 03 12 02930920.docs.exe

Source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/21@2/3

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe

File created: C:\Users\user\SystemRootDoc

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5708:120:WilError_03

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe

File created: C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a

Jump to behavior

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AddInProcess32.exe, 00000005.00000002.2117283137.0000000003080000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000003050000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.000000000305E000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000003073000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000003040000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Notice Letter 2025 03 12 02930920.docs.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe

File read: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe "C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe"
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe"
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: tier0_s64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: vstdlib_s64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Section loaded: msvcp290.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: tier0_s64.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: vstdlib_s64.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: msvcp290.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: tier0_s64.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: vstdlib_s64.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: wininet.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: ncrypt.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: ntasn1.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: msvcp290.dll
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Section loaded: icu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: More than 8191 > 100 exports found

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static file information: File size 50361824 > 1048576

Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10f7e00
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xef8600

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Notice Letter 2025 03 12 02930920.docs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\buildworker\steam_rel_client_win64\build\src\steamerrorreporter\win64\Release\steamerrorreporter64.pdb source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000000.872328581.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880796330.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000009.00000000.980236760.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983113344.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pkg.d7c6a10fb0263a69b4596321\node\out\Release\node.pdb source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF687349000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pkg.d7c6a10fb0263a69b4596321\node\out\Release\node.pdb) source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF687349000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\buildworker\steam_rel_client_win64\build\src\steamerrorreporter\win64\Release\steamerrorreporter64.pdb1 source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000000.872328581.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880796330.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000009.00000000.980236760.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983113344.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\buildworker\steam_rel_client_win64\build\src\tier0\win64\Release\tier0_s64.pdb source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.867832065.0000020AD782D000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871023653.0000020AD7893000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.882926560.00007FFBFA235000.00000002.00000001.01000000.00000006.sdmp, Notice Letter 2025 .exe, 00000009.00000002.984188825.00007FFBFA915000.00000002.00000001.01000000.0000000E.sdmp

Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Notice Letter 2025 03 12 02930920.docs.exe	Static PE information: section name: _RDATA
Source: msvcp290.dll.0.dr	Static PE information: section name: .managed
Source: msvcp290.dll.0.dr	Static PE information: section name: _RDATA
Source: vstdlib_s64.dll.0.dr	Static PE information: section name: _RDATA
Source: vstdlib_s64.dll.2.dr	Static PE information: section name: _RDATA
Source: msvcp290.dll.2.dr	Static PE information: section name: .managed
Source: msvcp290.dll.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: \notice letter 2025 03 12 02930920.docs.exe
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: \notice letter 2025 03 12 02930920.docs.exe
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: \notice letter 2025 03 12 02930920.docs.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	File created: C:\Users\user\SystemRootDoc\msvcp290.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\tier0_s64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	File created: C:\Users\user\SystemRootDoc\vstdlib_s64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\msvcp290.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	File created: C:\Users\user\SystemRootDoc\tier0_s64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	File created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vstdlib_s64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	File created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Notice Letter 2025			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Notice Letter 2025			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory allocated: 2007A6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory allocated: 2007A6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory allocated: 241126C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory allocated: 241326C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 1ADFE540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 1ADFE560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 1EE94AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 1EEB4AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 10E0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 4A60000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 244F4ED0000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 244F4EF0000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 2858B450000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: 285AB450000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 16D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 32D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5458			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4353			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 508	Thread sleep count: 5458 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 508	Thread sleep count: 4353 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7104	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: AddInProcess32.exe, 00000005.00000002.2111687665.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.0,
Source: Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: D61008	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41A000	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: B7A008	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41A000
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1032008

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Process created: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe "C:\Users\user~1\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"	Jump to behavior
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
Source: C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Source: conhost.exe, 00000001.00000002.2113171756.000002BE40701000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: conhost.exe, 00000001.00000002.2113171756.000002BE40701000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000001.00000002.2113171756.000002BE40701000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 00000001.00000002.2113171756.000002BE40701000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe	Queries volume information: C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Yara detected MassLogger RAT

Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2118827331.00000000033F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2116559550.0000000002B86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2117283137.0000000003086000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 00000002.00000002.880092133.00000241126C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Yara detected MassLogger RAT

Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: 00000002.00000002.879908885.000002007F000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982960558.000001EEA4AC1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.880120371.00000241226C1000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.866354007.0000020AD55F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1058981927.00000244F9800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1059109225.000002859B451000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.982490872.000001AE02C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110823725.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 03 12 02930920.docs.exe PID: 6920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Notice Letter 2025 .exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	312 Process Injection	11 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Notice Letter 2025 03 12 02930920.docs.exe	12%	Virustotal		Browse
Notice Letter 2025 03 12 02930920.docs.exe	5%	ReversingLabs	Win64.Trojan.Sonbokli

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\msvcp290.dll	13%	ReversingLabs
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\tier0_s64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vstdlib_s64.dll	16%	ReversingLabs
C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe	5%	ReversingLabs
C:\Users\user\SystemRootDoc\msvcp290.dll	13%	ReversingLabs
C:\Users\user\SystemRootDoc\tier0_s64.dll	0%	ReversingLabs
C:\Users\user\SystemRootDoc\vstdlib_s64.dll	16%	ReversingLabs

Source	Detection	Scanner	Label
https://url.spec.whatwg.org/#concept-url-origin	0%	Avira URL Cloud	safe
https://bugs.chromium.org/p/v8/issues/detail?id=10704	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash	0%	Avira URL Cloud	safe
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/#sec-timeclip	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	0%	Avira URL Cloud	safe
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape	0%	Avira URL Cloud	safe
https://v8.dev/blog/v8-release-89	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	0%	Avira URL Cloud	safe
https://tc39.es/proposal-iterator-helpers/#sec-iteratorprototype.some	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern	0%	Avira URL Cloud	safe
https://invisible-island.net/xterm/ctlseqs/ctlseqs.html	0%	Avira URL Cloud	safe
https://bugs.chromium.org/p/v8/issues/detail?id=6593	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	0%	Avira URL Cloud	safe
https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.16.1	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/nodejs/node/pull/36061#discussion_r533718029	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://url.spec.whatwg.org/#concept-url-origin	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc6455#section-1.3	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://reallyfreegeoip.orgd	AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://gist.github.com/XVilka/8346728#gistcomment-2823421	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node-v0.x-archive/issues/2876.	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/#sec-timeclip	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/v8/issues/detail?id=10704	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://console.spec.whatwg.org/#table	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.iana.org/assignments/tls-extensiontype-values	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/issues/35475	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/download/release/v16.16.0/node-v16.16.0.tar.gz	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/chalk/ansi-regex/blob/HEAD/index.js	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://console.spec.whatwg.org/#console-namespace	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/api/fs.html#fs_stat_time_values)	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://url.spec.whatwg.org/#url	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://encoding.spec.whatwg.org/#textencoder	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189l	AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/issues/13435	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp	false		high
https://github.com/tc39/proposal-weakrefs	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://goo.gl/t5IS6M).	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7230#section-3.2.2	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189d	AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://url.spec.whatwg.org/#concept-urlencoded-serializer	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.884157344.00007FFBFA9B1000.00000004.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp, powershell.exe, 00000003.00000002.914940107.000001BE00001000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp	false		high
https://nodejs.org/api/fs.html	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/21313	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mysticatea/abort-controller	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crash.steampowered.com/submitFailed	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866992770.0000020AD778E000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866138407.0000020AD76F1000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000000.872328581.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000002.00000002.880796330.00007FF62A1EC000.00000002.00000001.01000000.00000004.sdmp, Notice Letter 2025 .exe, 00000009.00000000.980236760.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983113344.00007FF7193BC000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.midnight-commander.org/browser/lib/tty/key.c	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityy	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.squid-cache.org/Doc/config/half_closed_clients/	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.934699439.000001BE10071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/a/5501711/3561	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/vercel/pkg/issues/1589	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.865997105.000000F9CD901000.00000004.00001000.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.866396270.0000020ACBA86000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.855153760.0000020ACBA7A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/33661	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://narwhaljs.org)	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/WICG/scheduling-apis	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tc39.es/proposal-iterator-helpers/#sec-iteratorprototype.some	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/#sec-promise.all	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tc39/proposal-iterator-helpers/issues/169	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.914940107.000001BE00229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp	false		high
https://v8.dev/blog/v8-release-89	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/issues/39707	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://reallyfreegeoip.org	AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/12607	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/#sec-line-terminators	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://sourcemaps.info/spec.html	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://invisible-island.net/xterm/ctlseqs/ctlseqs.html	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/pull/12342	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=6593	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/issues/39758	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/pull/34375	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/download/release/v16.16.0/win-x64/node.lib	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/pull/34010	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#dfn-default-iterator-object	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#es-iterable-entries	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#es-interfaces	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/issues	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/addaleax/eventemitter-asyncresource	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-warnings/	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954198363.0000020AD8156000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.871339405.0000020AD7343000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.954808047.0000020AD7AF4000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.864912430.0000020AD6F95000.00000004.00000020.00020000.00000000.sdmp, Notice Letter 2025 .exe, 00000002.00000002.884157344.00007FFBFA9B1000.00000004.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.883679500.00007FFBFA73F000.00000002.00000001.01000000.00000005.sdmp, Notice Letter 2025 .exe, 00000002.00000002.882328583.00007FFBFA183000.00000008.00000001.01000000.00000007.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983974829.00007FFBFA761000.00000004.00000001.01000000.0000000F.sdmp, Notice Letter 2025 .exe, 00000009.00000002.983440509.00007FFBFA0D3000.00000008.00000001.01000000.00000010.sdmp	false		high
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
https://url.spec.whatwg.org/#urlsearchparams	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp, Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000003.854505722.0000020ACD30E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/chalk/supports-color	Notice Letter 2025 03 12 02930920.docs.exe, 00000000.00000000.851014765.00007FF686949000.00000002.00000001.01000000.00000003.sdmp	false		high
http://reallyfreegeoip.org	AddInProcess32.exe, 00000005.00000002.2117283137.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637395
Start date and time:	2025-03-13 15:45:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Notice Letter 2025 03 12 02930920.docs.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/21@2/3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:46:51	API Interceptor	21x Sleep call for process: powershell.exe modified
10:47:22	API Interceptor	2x Sleep call for process: svchost.exe modified
15:46:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Notice Letter 2025 cmd.exe /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"
15:46:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Notice Letter 2025 cmd.exe /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	https://t.co/6BJID9q49h	Get hash	malicious	HTMLPhisher	Browse	tcerfw.wittnng.sbs/favicon.ico
	J8bamK92a3.exe	Get hash	malicious	FormBook	Browse	www.play-vanguard-nirvana.xyz/egs9/?9r=2m/uVQwqKH2EIWlawszTKzvIepBfVH/HI19qzylF05nDLsWuBLn1pb4DiFDKEzYOkwPMwL8bVA==&vZR=H2MpG0p
	0t7MXNEfCg.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	g1V10ssekg.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/n61y/?UPV=BOlfS7N9ZWkGRIMRgNC6B6+WUTyM673eSjZAzliNIDKZHnAeT7/5dfTbZtimq+dx8K4CQjPcymznAMXPWSrBBYPYz0JSQDMkWzhvpNbFnW2/OcjAWw==&YrV=FlsDgRMx
	0IrTeguWM7.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/ftbq/
	Shipping Document.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/6m32/
	Payment Record.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Invoice Remittance ref27022558.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	ujXpculHYDYhc6i.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sss2/five/fre.php
	368c6e62-b031-5b65-fd43-e7a610184138.eml	Get hash	malicious	HTMLPhisher	Browse	ce60771026585.oakdiiocese.org/p/298?session=770558a25b5d1fcbb8d81f113631d430f5b8d022cdc6d97cf6b16a412a3be9e6
193.122.6.168	wekissingbestgirleveryseenwithmygirl.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Yeni Sat#U0131nalma Sipari#U015fi.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	QUOTATION_FEBQUOTE312025PDF.scr.exe	Get hash	malicious	MSIL Logger	Browse	checkip.dyndns.org/
	Way bill & Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New Order RFQ- 19A20060.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	INQ_NO_097590_0109_Order.cmd	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	SIP_20252701095738583757327401213.bat.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	4kobC6KGC3.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	p7wgyD3kbI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	hcy2SdW2z6.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Bank Swift Payment.bat.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	2025 5595 TEKL#U0130F #U0130STE#U011e#U0130 - T#U00dcB#U0130TAK SAGE RFQ_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	QUOTATION_MARQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	193.122.130.0
	SOA Since OCT DEC 241738316681530012900.bat	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Win32.DropperX-gen.23511.10885.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO-2513203-PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	158.101.44.242
	efs.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	193.122.130.0
reallyfreegeoip.org	Bank Swift Payment.bat.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	2025 5595 TEKL#U0130F #U0130STE#U011e#U0130 - T#U00dcB#U0130TAK SAGE RFQ_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	QUOTATION_MARQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	104.21.32.1
	SOA Since OCT DEC 241738316681530012900.bat	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	SecuriteInfo.com.Win32.DropperX-gen.23511.10885.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	PO-2513203-PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	104.21.64.1
	efs.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.48.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	Bank Swift Payment.bat.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	2025 5595 TEKL#U0130F #U0130STE#U011e#U0130 - T#U00dcB#U0130TAK SAGE RFQ_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	QUOTATION_MARQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	193.122.130.0
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	158.101.44.242
	efs.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	category05 sc110-11#U3000_Z01G-00008D Siparis PO15804-25 - H64PO1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	SC110-11#U3000Order_Z01G-00008D Siparis PO15804-25 - H64PO1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	8QeI7CboDY.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
CLOUDFLARENETUS	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13&data=05%7C02%7Cteat@test.com%7Cf85134ec55e24fa0741708dd623d50ea%7C22def1f7e945453d836bda7282c42443%7C0%7C0%7C638774737677482831%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==%7C0%7C%7C%7C&sdata=AFWlQKGCYsB3szoYr99UdtJsHEuv5b0KPmvHih+dvhk=&reserved=0	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://app.storylane.io/share/bq4ugmizxawq	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.21.82.118
	Copy of Cheque.html	Get hash	malicious	KnowBe4	Browse	104.17.245.203
	http://insprocks.com/Insprock289.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	https://zcmp-semi.maillist-manage.jp/click/11ed2c6aa12966a/11ed2c6aa12ae03	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://llttfr.boa.ink/?fr=gemma.inglis@heritageportfolio.co.uk	Get hash	malicious	Unknown	Browse	104.18.186.31
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	https://zcmp-semi.maillist-manage.jp/click/11ed2c6aa12966a/11ed2c6aa12ae03	Get hash	malicious	Unknown	Browse	104.17.24.14
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Bank Swift Payment.bat.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
	2025 5595 TEKL#U0130F #U0130STE#U011e#U0130 - T#U00dcB#U0130TAK SAGE RFQ_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Order 20201103.exe	Get hash	malicious	RedLine	Browse	104.21.16.1
	SOA Since OCT DEC 241738316681530012900.bat	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	SecuriteInfo.com.Win32.DropperX-gen.23511.10885.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	PO-2513203-PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	104.21.16.1
	efs.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.16.1

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067220612354298
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqQ:2JIB/wUKUKQncEmYRTwh00
MD5:	68C088C4952E3315A648F6B947D00CB0
SHA1:	A2E759975DFF9070ECA9228AD81E679764A4B1AA
SHA-256:	22E1ABC1B9E49D08F48A801DE67958CE549D706EFBC473B694DFCAC31E71D904
SHA-512:	0988754C533BEC00D872ED3F0965805DF851FF9B55BB8BEA36BA7FF9527753A7C95388F839C84746051134B57F7A85CCF373A5801787C128B543B02D74A05365
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1801df52, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.79000504887896
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:7azaPvgurTd42UgSii
MD5:	3731B52A69FB788E014EB9AD440C4279
SHA1:	D7BE53394810377406DC1B8E718C9E208992290D
SHA-256:	E9131AB62ED0EA29D670039A4A64B8E0EBCB0FA3BB920A6BB47202260D0E9FDE
SHA-512:	E422775E4C3BB391BD388659BBBD74A4CBD39368C9C2DC3E5D6BA048F0EFA848C198777308E7967B778BF0BC8A3AA949F50912905C9C5EA38005C0C8C550D526
Malicious:	false
Preview:	...R... ...............X\...;...{......................0.`.....42...{5../...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................~../...}...................#4../...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08217438019209529
Encrypted:	false
SSDEEP:	3:VdYeEdmYQpkqNt/57Dek3JzKr79pwllEqW3l/TjzzQ/t:VdzrFPR3tmrYmd8/
MD5:	35CB2A2110A5AA805904D0C96383015E
SHA1:	6F47262F56D32567EE6E01AA58EED7BF54F339DA
SHA-256:	9E5E62B83E1B8A6BE4FA2D28D91421075FF894D3CA7E0F228A4EBBCF95178011
SHA-512:	4055321F574D5E610251B9653111E6E43B0C160BD0305A6384555DD39884BF27CD26A97102FF9B0948EB71A465CA1D92D38EAF7C83AA92469F3306AF2F605666
Malicious:	false
Preview:	.........................................;...{.../...}..42...{5.........42...{5.42...{5...Y.42...{59.................#4../...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe

Download File

Process:	C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	648288
Entropy (8bit):	6.372721273132514
Encrypted:	false
SSDEEP:	6144:WTTzzJeyp1RnC7HJnIApeX9vLSaXmWFiB3WOk6f7h9WgFER0u+GIIIIIIIhIIIIw:GTzNeypHnC7HdeXZEWFTOk6fmBm5GV
MD5:	573C3AA20CAB92C93663F0E475323557
SHA1:	647598A3A90B23787B83F0C23BA26A8B4B779592
SHA-256:	9EBEA5ECB5F86BCCF0564F563A35665876E5BCB1B66285A19965AF5F24534B4A
SHA-512:	06FBF4DFEA02AC62C81C9E47581D779891E2DA9113ED45F349AF2E4C52B86DA9701A807872A5CFC059C5553DE63BAB3A24953A06A63D82CF8BF877C3DC538694
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@................................... ...VLV..........).gBO$...........V../....'6x.@..d......_(l...[.%j ..Q).....K....%>...'.....S.CA..J.8........,.B.....`...B).-.....u..\|./5.................................................................................PE..d....).g.........."................(..........@............................. ...........`.....................................................x....p.......0...2......`,..........P...T.......................(.......@............... ............................text...4........................... ..`.rdata..............................@..@.data....N..........................@....pdata...2...0...4..................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\msvcp290.dll

Download File

Process:	C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3817984
Entropy (8bit):	6.680699463625683
Encrypted:	false
SSDEEP:	49152:umZhtlAqHNiFlMRPvF4/TvKsY+cDfWKHCuFJpPGxv3M/:xt9MmszSfGt
MD5:	DD0424F5575717819906FBAC9B9FBE4D
SHA1:	842C21F7D7AB0222A5F61BD35CDF314758B0726B
SHA-256:	9F2BE627ED9D5591EA6EE28DE38CDF49BEBCF656A10C789B32A8B335572B9D45
SHA-512:	753FEE0AD392E3F2906CE1AB91B004F23521959DFF148E182B1FEAFBBB25AC00358E2472FF1EFA37A93248782BD4FD7404E8ADE7CECC3780D357F6C3B4BC585F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.z..............?..8....?.......?.............Z.........................T............<.......<.......<......................PE..d...dl.g.........." ...'.F..........`.........................................;...........`.........................................p.5.h.....5......`:.@....P8..............p:.`.....0.T.................... 0.(...P.0.@............p...............................text....C.......D.................. ..`.managed.....`.......H.............. ..`.rdata......p.......J..............@..@.data...X....05..$....5.............@....pdata.......P8......(7.............@..@_RDATA.......P:......"9.............@..@.rsrc...@....`:......$9.............@..@.reloc..`....p:......,9.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll

Download File

Process:	C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe
File Type:	data
Category:	dropped
Size (bytes):	92685
Entropy (8bit):	5.683092792521934
Encrypted:	false
SSDEEP:	1536:smhwSMgDbSiyAkOmH1BNsQRubLhCcw9FMRHBbpbgA:BwSMgDbSFAkOmH1BNsQQbLhAMTbpB
MD5:	2131CC41B503813FD46C661CBE233B14
SHA1:	F4C5275ECBD8B1DEF16B67ACF7D1C3783D0FD6F4
SHA-256:	57AFA1D16BB4281776F91CBC75F9B7B82C83AB8F924AFD1E02F3C36A30700DA4
SHA-512:	674990B2C989DD3A9999F7065BEE75C70F28D68AD63475C70CE1309043244E73E2736AB0DF93BFD23734D415BEE91DB144A111CC5DAF8B37494D39153C817DEA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll, Author: unknown
Preview:	......j..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....nH...............P..`............... ........@.. ....................................`.................................\...O.................................................................................... ............... ..H............text...._... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B........................H.......(...4.......Z...p................................................}.....is.......................~...F...@...7...%...m...$...~...~...d...r...a...G...o...n...~.....(....&..( .....s!........s"........s#........s$........s%........Z........o8...........&..(9....&........".......Vs....(B...t...........(C..."~....+."~....+."~....+."~....+."~....+..b.r...p.oa...(....(@....:.~.....o....&:.(P....(Q......~3...,.~3...+.~1.....x...s....%.3...(.....*..(Y

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\tier0_s64.dll

Download File

Process:	C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	422496
Entropy (8bit):	6.524386798791996
Encrypted:	false
SSDEEP:	6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB
MD5:	DE738F87B7A558476D73D590EA20A3B9
SHA1:	EA2DA2C8B5C811EA798805D3E77250F12CF6DA76
SHA-256:	87B2D5CD0F667D8F72468FFD146DCF2AEBDF7E65DB575C04FFE6A4DF9C1F1850
SHA-512:	934A24556D0A4DD7643C03F96CB057FF25BCEECBC9795C4A30884AECC5AFD441FA99BFE0D978C8879F3FB10260373F055731F51A18775C55DE68FA716BCCB81B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................VLV......F...).g...=.F...2...0Ni.k...Fn..!..........m.]t.....8.4B..k.m'.i....F.@m..m..k.......j<[...a..KN-.l..S;.}....E.,..\..W...}/N........................................................................PE..d....).g.........." ....<.....................?..........................................`..........................................}...S......x............@..tC...F..`,......h.......T....................!..(...P...@............P..H............................text...L;.......<.................. ..`.rdata......P.......@..............@..@.data....E..........................@....pdata..tC...@...D..................@..@.rsrc...............................@..@.reloc..h............<..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vcruntime210.dll

Download File

Process:	C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe
File Type:	data
Category:	dropped
Size (bytes):	5651
Entropy (8bit):	7.962871096456411
Encrypted:	false
SSDEEP:	96:s5esB/dgPAsL3xlzevnJdgWnJgLlmk0SZAKGyu7vuNE29LXZrqQisPK1GzgkDV:mesBuNL3WjgWneLBTlGy2vuN7LXQziKE
MD5:	5B463F2D9F2DD278202437121C8C8081
SHA1:	3B69F69E1FDF80FB2DFEA8A6D7E0F2DC4910AF96
SHA-256:	11CEF34D7B5C3C26743DD30A3BEF771C53148753C420E5F1A40FAEADC630D1F6
SHA-512:	E0715445D7BDFFDE0733186D9F54D51395B88712B302C04C50B7D87E1C399A8D09B0210EB1561FD6F6EF08F52D28033A3030B5E493BF23DA521C6115B8CA15BA
Malicious:	false
Preview:	^....<..../x.n....n.js..Od_...z...A3..{.M....NP.%........R/Q ...K@9../..w..90......<.A.!h._.......<..uU.O..H?. t.h..{T.X.cC.l...V51_....R..D.B...c.P..h3..Qo.......<........v....tx..I(9...1..!...k...}.......C...lv.........=x.5.,.xVL..L+.A,...G..;.......^.....8..a^=...........@N..3.:.M.........Ny.u}....\|.>.`K..vw.....h7.b...k..!..].v...y5....<.r.a.m.7..W_tb.JvDj...9..P.n.....1..d..../.....#i..b.'.....1!.a......3..uz.~....,ns...~....B.w#..j.o.N...RX.A8.............._h..~....M.....84...q......L.cr.l.q.....&8iG.(.)..%.RYT./...-c.MTc....AI .">.u'.08..........N./..M. ."-<..v..4....k=.K'..-.yI.3I.93.4).....@}.............O}....1...4H.e.52.&.E._/.Z...s.\.........oX..3....\\|`5P....2.I...-.F..`a..H.a.R.tp...(7}..R....-..=..7`.:U.!..~..a...C..b&.....~.Z1_.d..7..y..t.fl4_...I...?.h.A...K=....=.][..sE..}e..=h>..A\|..N...G.{...d]"X>.y..{.N8....@}9V...P.k..C.B..P....#..by..S.F.&..".+.d.EoC.S.sNVx.@.\|'.M.3.0._....%.0....f.@..fl...."\,.H..w.q.!\...%.O...

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vstdlib_s64.dll

Download File

Process:	C:\Users\user\Desktop\Notice Letter 2025 03 12 02930920.docs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	6641152
Entropy (8bit):	6.897588641765396
Encrypted:	false
SSDEEP:	49152:Ju1laVkhH+ihCb4aVuSFvSuWdxRRXqrP4FjkIu5fQpbjuYTSYaAMQ2j/bzspwSHq:dRTu0rcbvKAjkxsEltwOyD
MD5:	9AD1CBC504C3B2D6F2D9FF5FBF53FF43
SHA1:	A2370F3264EE104AE90A4ED621552C00140C1FE0
SHA-256:	3DADBFBBE1B8F43A46EB2781ADBFED83E4400C1DFC33F85DB8F8EE9C173A7FB3
SHA-512:	9B3E6EE77DAC854731B930F3596F038B6D43C489B1F8EDA74A261EB4F12538ABA20A20E75309910951B3B2E8C1EC52F7110992A7C0EC5072B04DEFED1433BB2F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.X.z.6.z.6.z.6.(.3.\.6.(.2.q.6.(.5.s.6.s...v.6.1.7.i.6.z.7.<.6..p5.r.6..p2.].6.z.6.{.6..p3.3.6...6.{.6...4.{.6.........................PE..d...`l.g.........." ......:..~*..... .9.......................................x...........`..........................................y^..(..<.`.@.....x......Pt..B............x.....@.U.p.....................U.(.....U.8.............:.0............................text.....:.......:................. ..`.rdata....%...:...%...:.............@..@.data....p....`..J....`.............@....pdata...B...Pt..D....`.............@..@_RDATA........x......>e.............@..@.rsrc.........x......@e.............@..@.reloc........x......He.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a5t1om3.ed5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a10t0xwu.me5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0g4fsbx.l1o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xndllza0.f25.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	648288
Entropy (8bit):	6.372721273132514
Encrypted:	false
SSDEEP:	6144:WTTzzJeyp1RnC7HJnIApeX9vLSaXmWFiB3WOk6f7h9WgFER0u+GIIIIIIIhIIIIw:GTzNeypHnC7HdeXZEWFTOk6fmBm5GV
MD5:	573C3AA20CAB92C93663F0E475323557
SHA1:	647598A3A90B23787B83F0C23BA26A8B4B779592
SHA-256:	9EBEA5ECB5F86BCCF0564F563A35665876E5BCB1B66285A19965AF5F24534B4A
SHA-512:	06FBF4DFEA02AC62C81C9E47581D779891E2DA9113ED45F349AF2E4C52B86DA9701A807872A5CFC059C5553DE63BAB3A24953A06A63D82CF8BF877C3DC538694
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@................................... ...VLV..........).gBO$...........V../....'6x.@..d......_(l...[.%j ..Q).....K....%>...'.....S.CA..J.8........,.B.....`...B).-.....u..\|./5.................................................................................PE..d....).g.........."................(..........@............................. ...........`.....................................................x....p.......0...2......`,..........P...T.......................(.......@............... ............................text...4........................... ..`.rdata..............................@..@.data....N..........................@....pdata...2...0...4..................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\SystemRootDoc\msvcp290.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3817984
Entropy (8bit):	6.680699463625683
Encrypted:	false
SSDEEP:	49152:umZhtlAqHNiFlMRPvF4/TvKsY+cDfWKHCuFJpPGxv3M/:xt9MmszSfGt
MD5:	DD0424F5575717819906FBAC9B9FBE4D
SHA1:	842C21F7D7AB0222A5F61BD35CDF314758B0726B
SHA-256:	9F2BE627ED9D5591EA6EE28DE38CDF49BEBCF656A10C789B32A8B335572B9D45
SHA-512:	753FEE0AD392E3F2906CE1AB91B004F23521959DFF148E182B1FEAFBBB25AC00358E2472FF1EFA37A93248782BD4FD7404E8ADE7CECC3780D357F6C3B4BC585F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.z..............?..8....?.......?.............Z.........................T............<.......<.......<......................PE..d...dl.g.........." ...'.F..........`.........................................;...........`.........................................p.5.h.....5......`:.@....P8..............p:.`.....0.T.................... 0.(...P.0.@............p...............................text....C.......D.................. ..`.managed.....`.......H.............. ..`.rdata......p.......J..............@..@.data...X....05..$....5.............@....pdata.......P8......(7.............@..@_RDATA.......P:......"9.............@..@.rsrc...@....`:......$9.............@..@.reloc..`....p:......,9.............@..B................................................................................................................................................................

C:\Users\user\SystemRootDoc\nasrallah_x86.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe
File Type:	data
Category:	dropped
Size (bytes):	92685
Entropy (8bit):	5.683092792521934
Encrypted:	false
SSDEEP:	1536:smhwSMgDbSiyAkOmH1BNsQRubLhCcw9FMRHBbpbgA:BwSMgDbSFAkOmH1BNsQQbLhAMTbpB
MD5:	2131CC41B503813FD46C661CBE233B14
SHA1:	F4C5275ECBD8B1DEF16B67ACF7D1C3783D0FD6F4
SHA-256:	57AFA1D16BB4281776F91CBC75F9B7B82C83AB8F924AFD1E02F3C36A30700DA4
SHA-512:	674990B2C989DD3A9999F7065BEE75C70F28D68AD63475C70CE1309043244E73E2736AB0DF93BFD23734D415BEE91DB144A111CC5DAF8B37494D39153C817DEA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, Author: unknown
Preview:	......j..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....nH...............P..`............... ........@.. ....................................`.................................\...O.................................................................................... ............... ..H............text...._... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B........................H.......(...4.......Z...p................................................}.....is.......................~...F...@...7...%...m...$...~...~...d...r...a...G...o...n...~.....(....&..( .....s!........s"........s#........s$........s%........Z........o8...........&..(9....&........".......Vs....(B...t...........(C..."~....+."~....+."~....+."~....+."~....+..b.r...p.oa...(....(@....:.~.....o....&:.(P....(Q......~3...,.~3...+.~1.....x...s....%.3...(.....*..(Y

C:\Users\user\SystemRootDoc\tier0_s64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	422496
Entropy (8bit):	6.524386798791996
Encrypted:	false
SSDEEP:	6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB
MD5:	DE738F87B7A558476D73D590EA20A3B9
SHA1:	EA2DA2C8B5C811EA798805D3E77250F12CF6DA76
SHA-256:	87B2D5CD0F667D8F72468FFD146DCF2AEBDF7E65DB575C04FFE6A4DF9C1F1850
SHA-512:	934A24556D0A4DD7643C03F96CB057FF25BCEECBC9795C4A30884AECC5AFD441FA99BFE0D978C8879F3FB10260373F055731F51A18775C55DE68FA716BCCB81B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................VLV......F...).g...=.F...2...0Ni.k...Fn..!..........m.]t.....8.4B..k.m'.i....F.@m..m..k.......j<[...a..KN-.l..S;.}....E.,..\..W...}/N........................................................................PE..d....).g.........." ....<.....................?..........................................`..........................................}...S......x............@..tC...F..`,......h.......T....................!..(...P...@............P..H............................text...L;.......<.................. ..`.rdata......P.......@..............@..@.data....E..........................@....pdata..tC...@...D..................@..@.rsrc...............................@..@.reloc..h............<..............@..B........................................................................................................................................................................................................................

C:\Users\user\SystemRootDoc\vcruntime210.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe
File Type:	data
Category:	dropped
Size (bytes):	5651
Entropy (8bit):	7.962871096456411
Encrypted:	false
SSDEEP:	96:s5esB/dgPAsL3xlzevnJdgWnJgLlmk0SZAKGyu7vuNE29LXZrqQisPK1GzgkDV:mesBuNL3WjgWneLBTlGy2vuN7LXQziKE
MD5:	5B463F2D9F2DD278202437121C8C8081
SHA1:	3B69F69E1FDF80FB2DFEA8A6D7E0F2DC4910AF96
SHA-256:	11CEF34D7B5C3C26743DD30A3BEF771C53148753C420E5F1A40FAEADC630D1F6
SHA-512:	E0715445D7BDFFDE0733186D9F54D51395B88712B302C04C50B7D87E1C399A8D09B0210EB1561FD6F6EF08F52D28033A3030B5E493BF23DA521C6115B8CA15BA
Malicious:	false
Preview:	^....<..../x.n....n.js..Od_...z...A3..{.M....NP.%........R/Q ...K@9../..w..90......<.A.!h._.......<..uU.O..H?. t.h..{T.X.cC.l...V51_....R..D.B...c.P..h3..Qo.......<........v....tx..I(9...1..!...k...}.......C...lv.........=x.5.,.xVL..L+.A,...G..;.......^.....8..a^=...........@N..3.:.M.........Ny.u}....\|.>.`K..vw.....h7.b...k..!..].v...y5....<.r.a.m.7..W_tb.JvDj...9..P.n.....1..d..../.....#i..b.'.....1!.a......3..uz.~....,ns...~....B.w#..j.o.N...RX.A8.............._h..~....M.....84...q......L.cr.l.q.....&8iG.(.)..%.RYT./...-c.MTc....AI .">.u'.08..........N./..M. ."-<..v..4....k=.K'..-.yI.3I.93.4).....@}.............O}....1...4H.e.52.&.E._/.Z...s.\.........oX..3....\\|`5P....2.I...-.F..`a..H.a.R.tp...(7}..R....-..=..7`.:U.!..~..a...C..b&.....~.Z1_.d..7..y..t.fl4_...I...?.h.A...K=....=.][..sE..}e..=h>..A\|..N...G.{...d]"X>.y..{.N8....@}9V...P.k..C.B..P....#..by..S.F.&..".+.d.EoC.S.sNVx.@.\|'.M.3.0._....%.0....f.@..fl...."\,.H..w.q.!\...%.O...

C:\Users\user\SystemRootDoc\vstdlib_s64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6641152
Entropy (8bit):	6.897588641765396
Encrypted:	false
SSDEEP:	49152:Ju1laVkhH+ihCb4aVuSFvSuWdxRRXqrP4FjkIu5fQpbjuYTSYaAMQ2j/bzspwSHq:dRTu0rcbvKAjkxsEltwOyD
MD5:	9AD1CBC504C3B2D6F2D9FF5FBF53FF43
SHA1:	A2370F3264EE104AE90A4ED621552C00140C1FE0
SHA-256:	3DADBFBBE1B8F43A46EB2781ADBFED83E4400C1DFC33F85DB8F8EE9C173A7FB3
SHA-512:	9B3E6EE77DAC854731B930F3596F038B6D43C489B1F8EDA74A261EB4F12538ABA20A20E75309910951B3B2E8C1EC52F7110992A7C0EC5072B04DEFED1433BB2F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.X.z.6.z.6.z.6.(.3.\.6.(.2.q.6.(.5.s.6.s...v.6.1.7.i.6.z.7.<.6..p5.r.6..p2.].6.z.6.{.6..p3.3.6...6.{.6...4.{.6.........................PE..d...`l.g.........." ......:..~*..... .9.......................................x...........`..........................................y^..(..<.`.@.....x......Pt..B............x.....@.U.p.....................U.(.....U.8.............:.0............................text.....:.......:................. ..`.rdata....%...:...%...:.............@..@.data....p....`..J....`.............@....pdata...B...Pt..D....`.............@..@_RDATA........x......>e.............@..@.rsrc.........x......@e.............@..@.reloc........x......He.............@..B................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.890374164829588
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Notice Letter 2025 03 12 02930920.docs.exe
File size:	50'361'824 bytes
MD5:	f36c74bdf4d6a5cf72291eb97be7e611
SHA1:	9ca5426bd908436a8ca51f6ff50bff9f4d3af5de
SHA256:	1ee248f86ddf0bfb05150a132db11c337baa46fd619f64a7e1cb1885fab4d35c
SHA512:	1b049dfce05f243cd7a68b5ca549aa8fdd335d8f620f5c35fb813d528fd151701987603c55d77b0f52adcab4bfb9d836b02f429ba53d1efff9cafc388765d55c
SSDEEP:	393216:C76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfJnVQx4urYsANulL7Na:C0LoCOn+2Js4urYDNulLBiu+
TLSH:	04B7BD0372E60095E8B7D2388AA75503D773B8635731DACF326D06152FBBAD49A7B720
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......v.@.2...2...2.....-......+............`..!...`.-.8...`.+.S...T...>...2...,.....-.0.....+.P......c...../.%...2./.......'.6..

File Icon


Icon Hash:	bcf1e3f3d1d1dc00

Static PE Info

General

Entrypoint:	0x1410ac2f8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62C8BD42 [Fri Jul 8 23:26:58 2022 UTC]
TLS Callbacks:	0x410ac004, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	66b10d8b5718b0fd6fb4865843d44280

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3BFCBB8C50h
dec eax
add esp, 28h
jmp 00007F3BFCBB86A7h
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F3BFCBB7D65h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
inc ebp
sbb eax, eax
inc ecx
neg eax
inc esp
add eax, eax
inc esp
test dword ptr [ebx+04h], eax
je 00007F3BFCBB8843h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F3BFCBBB519h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
dec eax
lea ecx, dword ptr [0121CD8Dh]
dec eax
jmp dword ptr [0004CE0Eh]
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+18h], ebx
dec eax
mov dword ptr [eax+20h], esi
dec eax
mov dword ptr [eax+10h], edx
dec eax
mov dword ptr [eax+08h], ecx
push edi
inc ecx
push esi
inc ecx
push edi
dec eax
sub esp, 30h
dec ebp
mov edi, ecx
dec ebp
mov esi, eax
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1dde2c0	0x2109e4	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1feeca4	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x239a000	0x8b5c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x22cb000	0xcd8a8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23a3000	0x1c324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ce1520	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1ce1700	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ce1590	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10f9000	0xc28	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10f7c40	0x10f7e00	7ff811e53e91692c74554cb15f627f2e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10f9000	0xef85c4	0xef8600	cfe1d3733b64d230fcfe69aa26855f93	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1ff2000	0x2d892c	0x2da00	d2d86d1a7fd7661de7074d191730e9be	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x22cb000	0xcd8a8	0xcda00	7c7dd899fc914d0919cf1eb2bef4e7fb	False	0.47860942249240124	data	6.780767036445384	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x2399000	0xf4	0x200	27931c106c58fbe03bb12872283529b7	False	0.3046875	data	2.875091738089016	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x239a000	0x8b5c	0x22c00	5d3925b515c584afece08b74b5ce5866	False	0.23868873651079137	data	4.792177097493331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x23a3000	0x1c324	0x1c400	81be29a4ac9aa11476a8fae36ba3ee7a	False	0.17890106471238937	data	5.488361285409069	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x239a480	0x8488	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9619783070030653
RT_GROUP_ICON	0x239a130	0x14	data	English	United States	0.95
RT_VERSION	0x23a2908	0x254	data	English	United States	0.5335570469798657
RT_MANIFEST	0x239a148	0x336	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (762), with CRLF line terminators	English	United States	0.5048661800486618

Imports

DLL	Import
dbghelp.dll	SymSetSearchPathW, SymGetSearchPathW, SymGetModuleBase64, SymFunctionTableAccess64, StackWalk64, SymSetOptions, SymFromAddr, SymInitialize, SymGetLineFromAddr64, SymCleanup, UnDecorateSymbolName
WS2_32.dll	getnameinfo, freeaddrinfo, getaddrinfo, WSACleanup, WSASetLastError, ntohs, htonl, ntohl, closesocket, getsockopt, WSAStartup, send, gethostname, __WSAFDIsSet, gethostbyname, accept, sendto, recvfrom, WSAIoctl, recv, FreeAddrInfoW, GetAddrInfoW, GetNameInfoW, select, WSASocketW, WSASend, WSAGetOverlappedResult, WSADuplicateSocketW, shutdown, listen, htons, WSASendTo, WSARecvFrom, WSARecv, setsockopt, getsockname, getpeername, ioctlsocket, connect, bind, WSAGetLastError, socket
IPHLPAPI.DLL	ConvertInterfaceIndexToLuid, GetAdaptersAddresses, ConvertInterfaceLuidToNameW
PSAPI.DLL	EnumProcessModules, GetProcessMemoryInfo, GetModuleFileNameExW
USERENV.dll	GetUserProfileDirectoryW
ADVAPI32.dll	CryptSetHashParam, GetUserNameW, RegCloseKey, RegEnumKeyExA, RegOpenKeyExA, RegQueryValueExA, RegEnumKeyExW, EventWriteTransfer, EventUnregister, EventRegister, ReportEventW, RegisterEventSourceW, DeregisterEventSource, CryptEnumProvidersW, CryptSignHashW, CryptDestroyHash, CryptCreateHash, CryptDecrypt, CryptExportKey, CryptGetUserKey, CryptGetProvParam, OpenProcessToken, CryptDestroyKey, CryptReleaseContext, CryptAcquireContextW, SetSecurityInfo, GetSecurityInfo, SetEntriesInAclA, FreeSid, AllocateAndInitializeSid, SystemFunction036, RegGetValueW, RegQueryValueExW, RegOpenKeyExW, RegQueryInfoKeyW
USER32.dll	GetProcessWindowStation, MapVirtualKeyW, DispatchMessageA, TranslateMessage, MessageBoxW, GetSystemMetrics, GetMessageA, GetUserObjectInformationW
CRYPT32.dll	CertCloseStore, CertEnumCertificatesInStore, CertFindCertificateInStore, CertDuplicateCertificateContext, CertFreeCertificateContext, CertGetCertificateContextProperty, CertOpenStore
bcrypt.dll	BCryptGenRandom
KERNEL32.dll	RtlCaptureContext, RtlLookupFunctionEntry, WaitForSingleObjectEx, GetCPInfo, GetStringTypeW, InitializeSListHead, IsProcessorFeaturePresent, UnhandledExceptionFilter, InterlockedPushEntrySList, RtlUnwindEx, RtlPcToFileHeader, RaiseException, ExitProcess, SetStdHandle, CreateThread, ExitThread, FreeLibraryAndExitThread, GetFileAttributesExW, SetFileAttributesW, GetConsoleOutputCP, GetDriveTypeW, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, SetEndOfFile, OutputDebugStringW, HeapSize, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetProcessHeap, CreateEventW, InitializeConditionVariable, VerSetConditionMask, VerifyVersionInfoW, GetEnvironmentVariableA, WideCharToMultiByte, GetLastError, GetLocalTime, SetConsoleCtrlHandler, CloseHandle, WaitForSingleObject, CreateRemoteThread, OpenProcess, OpenFileMappingW, MapViewOfFile, UnmapViewOfFile, GetFileType, RemoveVectoredExceptionHandler, RtlCaptureStackBackTrace, GetStdHandle, GetCurrentProcess, GetCurrentProcessId, VirtualQuery, MultiByteToWideChar, WriteConsoleW, LocalFree, FormatMessageA, InitOnceExecuteOnce, CreateEventA, GetModuleHandleA, GetProcAddress, LoadLibraryA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentVariableW, SetEnvironmentVariableW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetTempPathW, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, Sleep, GetProcessTimes, SetPriorityClass, GetPriorityClass, GlobalMemoryStatusEx, GetSystemInfo, GetSystemTimeAsFileTime, GetVersionExW, GetModuleFileNameW, GetProcessIoCounters, VerifyVersionInfoA, FileTimeToSystemTime, GetConsoleTitleW, SetConsoleTitleW, CreateToolhelp32Snapshot, Process32First, Process32Next, SetHandleInformation, CreateIoCompletionPort, SetFileCompletionNotificationModes, CreateFileA, CreateFileW, DuplicateHandle, PostQueuedCompletionStatus, SetEvent, ResetEvent, QueueUserWorkItem, RegisterWaitForSingleObject, UnregisterWait, GetConsoleMode, SetConsoleMode, GetNumberOfConsoleInputEvents, ReadConsoleInputW, ReadConsoleW, FillConsoleOutputCharacterW, FillConsoleOutputAttribute, GetConsoleCursorInfo, SetConsoleCursorInfo, GetConsoleScreenBufferInfo, SetConsoleCursorPosition, SetConsoleTextAttribute, WriteConsoleInputW, CancelIoEx, CancelIo, SwitchToThread, GetStartupInfoW, GetFileAttributesW, TerminateProcess, GetExitCodeProcess, CreateProcessW, UnregisterWaitEx, CreateJobObjectW, AssignProcessToJobObject, SetInformationJobObject, LCMapStringW, TryEnterCriticalSection, DeleteCriticalSection, RtlUnwind, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableCS, ReleaseSemaphore, CreateSemaphoreW, GetCurrentThread, ResumeThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetNativeSystemInfo, CreateSemaphoreA, FlushFileBuffers, ReadFile, WriteFile, ConnectNamedPipe, SetNamedPipeHandleState, PeekNamedPipe, CreateNamedPipeW, WaitNamedPipeW, CancelSynchronousIo, CreateNamedPipeA, GetNamedPipeHandleStateA, GetLongPathNameW, GetShortPathNameW, ReadDirectoryChangesW, CreateDirectoryW, FindClose, FindFirstFileW, FindNextFileW, GetDiskFreeSpaceW, GetFileInformationByHandle, GetFileSizeEx, GetFinalPathNameByHandleW, GetFullPathNameW, RemoveDirectoryW, SetFilePointerEx, SetFileTime, DeviceIoControl, FlushViewOfFile, CreateFileMappingA, ReOpenFile, CopyFileW, MoveFileExW, CreateHardLinkW, GetFileInformationByHandleEx, CreateSymbolicLinkW, DebugBreak, FreeLibrary, LoadLibraryExW, SetErrorMode, GetQueuedCompletionStatus, ReadConsoleA, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, LoadLibraryW, GetModuleHandleW, GetSystemTime, SystemTimeToFileTime, FormatMessageW, SwitchToFiber, DeleteFiber, CreateFiber, ConvertFiberToThread, ConvertThreadToFiber, RtlVirtualUnwind, GetModuleHandleExW, AddVectoredExceptionHandler, RtlAddFunctionTable, RtlDeleteFunctionTable, VirtualProtect, IsDebuggerPresent, OutputDebugStringA, OpenThread, SuspendThread, GetThreadContext, GetLocaleInfoEx, GetNumberFormatEx, GetCurrencyFormatEx, ResolveLocaleName, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, GetTimeFormatEx, GetDateFormatEx, GetVersionExA, ExpandEnvironmentStringsA, GetWindowsDirectoryA, GetTickCount, GetACP, GetDynamicTimeZoneInformation, GetGeoInfoW, GetUserGeoID, CreateFileMappingW, LocaleNameToLCID, LCIDToLocaleName, ReleaseSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockExclusive, AcquireSRWLockShared, TryAcquireSRWLockExclusive, TryAcquireSRWLockShared, DeleteFileA, GetFileSize, GetTempPathA, GetTempFileNameA, GetThreadTimes, VirtualAlloc, VirtualFree, SetThreadPriority, GetThreadPriority, QueryThreadCycleTime, SleepConditionVariableSRW, SetUnhandledExceptionFilter, InitializeSRWLock, InitializeCriticalSectionEx, InitOnceBeginInitialize, InitOnceComplete, EncodePointer, DecodePointer, LCMapStringEx, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree
WINMM.dll	timeGetTime

Exports

Name	Ordinal	Address
??$Add@VIsolate@internal@v8@@@?$Dictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	1	0x1407e6ea0
??$Add@VIsolate@internal@v8@@@?$Dictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	2	0x1407e7060
??$Add@VIsolate@internal@v8@@@?$Dictionary@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVIsolate@12@V312@IV?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	3	0x1407e71b0
??$Add@VIsolate@internal@v8@@@?$Dictionary@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVIsolate@12@V312@IV?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	4	0x1407e73b0
??$Add@VIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@SA?AV?$MaybeHandle@VOrderedNameDictionary@internal@v8@@@12@PEAVIsolate@12@V?$Handle@VOrderedNameDictionary@internal@v8@@@12@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@@Z	5	0x1407e0350
??$Add@VLocalIsolate@internal@v8@@@?$Dictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	6	0x1407e7570
??$Add@VLocalIsolate@internal@v8@@@?$Dictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	7	0x1407e7730
??$Add@VLocalIsolate@internal@v8@@@?$Dictionary@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@IV?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	8	0x1407e7870
??$Add@VLocalIsolate@internal@v8@@@?$Dictionary@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@IV?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex@12@@Z	9	0x1407e7a00
??$Add@VLocalIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@SA?AV?$MaybeHandle@VOrderedNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V?$Handle@VOrderedNameDictionary@internal@v8@@@12@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@@Z	10	0x1407e0620
??$Allocate@VIsolate@internal@v8@@@AstConsString@internal@v8@@AEBA?AV?$Handle@VString@internal@v8@@@12@PEAVIsolate@12@@Z	11	0x140aff650
??$Allocate@VIsolate@internal@v8@@@DescriptorArray@internal@v8@@SA?AV?$Handle@VDescriptorArray@internal@v8@@@12@PEAVIsolate@12@HHW4AllocationType@12@@Z	12	0x1407e7be0
??$Allocate@VIsolate@internal@v8@@@OrderedHashMap@internal@v8@@SA?AV?$MaybeHandle@VOrderedHashMap@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@@Z	13	0x1407e0be0
??$Allocate@VIsolate@internal@v8@@@OrderedHashSet@internal@v8@@SA?AV?$MaybeHandle@VOrderedHashSet@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@@Z	14	0x1407e0c00
??$Allocate@VIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@SA?AV?$MaybeHandle@VOrderedNameDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@@Z	15	0x1407e0c20
??$Allocate@VLocalIsolate@internal@v8@@@AstConsString@internal@v8@@AEBA?AV?$Handle@VString@internal@v8@@@12@PEAVLocalIsolate@12@@Z	16	0x140aff700
??$Allocate@VLocalIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@SA?AV?$MaybeHandle@VOrderedNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@@Z	17	0x1407e0c50
??$AllocateFlat@VIsolate@internal@v8@@@AstConsString@internal@v8@@QEBA?AV?$Handle@VString@internal@v8@@@12@PEAVIsolate@12@@Z	18	0x140aff7b0
??$AllocateFlat@VLocalIsolate@internal@v8@@@AstConsString@internal@v8@@QEBA?AV?$Handle@VString@internal@v8@@@12@PEAVLocalIsolate@12@@Z	19	0x140aff9b0
??$AllocatePage@$00VSemiSpace@internal@v8@@@MemoryAllocator@internal@v8@@QEAAPEAVPage@12@_KPEAVSemiSpace@12@W4Executability@12@@Z	20	0x140973ce0
??$AllocatePage@$0A@VPagedSpace@internal@v8@@@MemoryAllocator@internal@v8@@QEAAPEAVPage@12@_KPEAVPagedSpace@12@W4Executability@12@@Z	21	0x140973d50
??$AllocatePage@$0A@VSemiSpace@internal@v8@@@MemoryAllocator@internal@v8@@QEAAPEAVPage@12@_KPEAVSemiSpace@12@W4Executability@12@@Z	22	0x140973d90
??$AllocateScopeInfos@VIsolate@internal@v8@@@DeclarationScope@internal@v8@@SAXPEAVParseInfo@12@PEAVIsolate@12@@Z	23	0x140af0bd0
??$AllocateScopeInfos@VLocalIsolate@internal@v8@@@DeclarationScope@internal@v8@@SAXPEAVParseInfo@12@PEAVLocalIsolate@12@@Z	24	0x140af0c80
??$AllocateScopeInfosRecursively@VIsolate@internal@v8@@@Scope@internal@v8@@AEAAXPEAVIsolate@12@V?$MaybeHandle@VScopeInfo@internal@v8@@@12@@Z	25	0x140af0d30
??$AllocateScopeInfosRecursively@VLocalIsolate@internal@v8@@@Scope@internal@v8@@AEAAXPEAVLocalIsolate@12@V?$MaybeHandle@VScopeInfo@internal@v8@@@12@@Z	26	0x140af0dc0
??$AllocateSlotSet@$00@MemoryChunk@internal@v8@@QEAAPEAVSlotSet@12@XZ	27	0x140972d00
??$AllocateSlotSet@$0A@@MemoryChunk@internal@v8@@QEAAPEAVSlotSet@12@XZ	28	0x140972d10
??$At@VIsolate@internal@v8@@@ConstantArrayBuilder@interpreter@internal@v8@@QEBA?AV?$MaybeHandle@VObject@internal@v8@@@23@_KPEAVIsolate@23@@Z	29	0x1408f40c0
??$At@VLocalIsolate@internal@v8@@@ConstantArrayBuilder@interpreter@internal@v8@@QEBA?AV?$MaybeHandle@VObject@internal@v8@@@23@_KPEAVLocalIsolate@23@@Z	30	0x1408f4180
??$BigIntLiteral@VIsolate@internal@v8@@@internal@v8@@YA?AV?$MaybeHandle@VBigInt@internal@v8@@@01@PEAVIsolate@01@PEBD@Z	31	0x1408cb990
??$BigIntLiteral@VLocalIsolate@internal@v8@@@internal@v8@@YA?AV?$MaybeHandle@VBigInt@internal@v8@@@01@PEAVLocalIsolate@01@PEBD@Z	32	0x1408cbc20
??$BuildValue@VIsolate@internal@v8@@@Literal@internal@v8@@QEBA?AV?$Handle@VObject@internal@v8@@@12@PEAVIsolate@12@@Z	33	0x140afcb10
??$BuildValue@VLocalIsolate@internal@v8@@@Literal@internal@v8@@QEBA?AV?$Handle@VObject@internal@v8@@@12@PEAVLocalIsolate@12@@Z	34	0x140afcd40
??$ConvertDouble@H@internal@v8@@YAHN@Z	35	0x140b03fc0
??$ConvertDouble@I@internal@v8@@YAIN@Z	36	0x140b03fc0
??$ConvertDouble@M@internal@v8@@YAMN@Z	37	0x140544a10
??$ConvertDouble@N@internal@v8@@YANN@Z	38	0x140078990
??$ConvertDouble@_J@internal@v8@@YA_JN@Z	39	0x140b03fd0
??$ConvertDouble@_K@internal@v8@@YA_KN@Z	40	0x140b03fd0
??$ConvertDouble@_N@internal@v8@@YA_NN@Z	41	0x140b03fe0
??$Create@VIsolate@internal@v8@@@ScopeInfo@internal@v8@@SA?AV?$Handle@VScopeInfo@internal@v8@@@12@PEAVIsolate@12@PEAVZone@12@PEAVScope@12@V?$MaybeHandle@VScopeInfo@internal@v8@@@12@@Z	42	0x1407d8ff0
??$Create@VLocalIsolate@internal@v8@@@ScopeInfo@internal@v8@@SA?AV?$Handle@VScopeInfo@internal@v8@@@12@PEAVLocalIsolate@12@PEAVZone@12@PEAVScope@12@V?$MaybeHandle@VScopeInfo@internal@v8@@@12@@Z	43	0x1407d9b00
??$CreateScript@VIsolate@internal@v8@@@ParseInfo@internal@v8@@QEAA?AV?$Handle@VScript@internal@v8@@@12@PEAVIsolate@12@V?$Handle@VString@internal@v8@@@12@V?$MaybeHandle@VFixedArray@internal@v8@@@12@VScriptOriginOptions@2@W4NativesFlag@12@@Z	44	0x1407b1e30
??$CreateScript@VLocalIsolate@internal@v8@@@ParseInfo@internal@v8@@QEAA?AV?$Handle@VScript@internal@v8@@@12@PEAVLocalIsolate@12@V?$Handle@VString@internal@v8@@@12@V?$MaybeHandle@VFixedArray@internal@v8@@@12@VScriptOriginOptions@2@W4NativesFlag@12@@Z	45	0x1407b1fe0
??$Decode@E@Utf8Decoder@internal@v8@@QEAAXPEAEAEBV?$Vector@$$CBE@base@2@@Z	46	0x1406bcb40
??$Decode@G@Utf8Decoder@internal@v8@@QEAAXPEAGAEBV?$Vector@$$CBE@base@2@@Z	47	0x1406bcc80
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VCompilationCacheTable@internal@v8@@VCompilationCacheShape@23@@internal@v8@@SA?AV?$Handle@VCompilationCacheTable@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	48	0x1407e8de0
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VEphemeronHashTable@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	49	0x1407e8f40
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	50	0x1407e90a0
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	51	0x1407e9200
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	52	0x1407e9360
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VObjectHashSet@internal@v8@@VObjectHashSetShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashSet@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	53	0x1407e94c0
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashTable@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	54	0x1407e9620
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	55	0x1407e9780
??$EnsureCapacity@VIsolate@internal@v8@@@?$HashTable@VStringSet@internal@v8@@VStringSetShape@23@@internal@v8@@SA?AV?$Handle@VStringSet@internal@v8@@@12@PEAVIsolate@12@V312@HW4AllocationType@12@@Z	56	0x1407e98e0
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VCompilationCacheTable@internal@v8@@VCompilationCacheShape@23@@internal@v8@@SA?AV?$Handle@VCompilationCacheTable@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	57	0x1407e9a40
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VEphemeronHashTable@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	58	0x1407e9ba0
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	59	0x1407e9d00
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	60	0x1407e9e60
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	61	0x1407e9fc0
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VObjectHashSet@internal@v8@@VObjectHashSetShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashSet@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	62	0x1407ea120
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashTable@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	63	0x1407ea280
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	64	0x1407ea3e0
??$EnsureCapacity@VLocalIsolate@internal@v8@@@?$HashTable@VStringSet@internal@v8@@VStringSetShape@23@@internal@v8@@SA?AV?$Handle@VStringSet@internal@v8@@@12@PEAVLocalIsolate@12@V312@HW4AllocationType@12@@Z	65	0x1407ea540
??$EnsureGrowable@VIsolate@internal@v8@@@?$OrderedHashTable@VOrderedHashMap@internal@v8@@$01@internal@v8@@SA?AV?$MaybeHandle@VOrderedHashMap@internal@v8@@@12@PEAVIsolate@12@V?$Handle@VOrderedHashMap@internal@v8@@@12@@Z	66	0x1407e0d60
??$EnsureGrowable@VIsolate@internal@v8@@@?$OrderedHashTable@VOrderedHashSet@internal@v8@@$00@internal@v8@@SA?AV?$MaybeHandle@VOrderedHashSet@internal@v8@@@12@PEAVIsolate@12@V?$Handle@VOrderedHashSet@internal@v8@@@12@@Z	67	0x1407e0dd0
??$FindEntry@VIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@QEAA?AVInternalIndex@12@PEAVIsolate@12@VObject@12@@Z	68	0x1407e0e40
??$FindEntry@VLocalIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@QEAA?AVInternalIndex@12@PEAVLocalIsolate@12@VObject@12@@Z	69	0x1407e0e40
??$Free@$00@MemoryAllocator@internal@v8@@QEAAXPEAVMemoryChunk@12@@Z	70	0x140973f20
??$Free@$01@MemoryAllocator@internal@v8@@QEAAXPEAVMemoryChunk@12@@Z	71	0x140973f50
??$Free@$02@MemoryAllocator@internal@v8@@QEAAXPEAVMemoryChunk@12@@Z	72	0x140973fc0
??$Free@$0A@@MemoryAllocator@internal@v8@@QEAAXPEAVMemoryChunk@12@@Z	73	0x140974030
??$GetBoilerplateValue@VIsolate@internal@v8@@@MaterializedLiteral@internal@v8@@IEAA?AV?$Handle@VObject@internal@v8@@@12@PEAVExpression@12@PEAVIsolate@12@@Z	74	0x140afd000
??$GetBoilerplateValue@VLocalIsolate@internal@v8@@@MaterializedLiteral@internal@v8@@IEAA?AV?$Handle@VObject@internal@v8@@@12@PEAVExpression@12@PEAVLocalIsolate@12@@Z	75	0x140afd0a0
??$GetConstantForIndexOperand@VIsolate@internal@v8@@@BytecodeArrayIterator@interpreter@internal@v8@@QEBA?AV?$Handle@VObject@internal@v8@@@23@HPEAVIsolate@23@@Z	76	0x140913450
??$InitFromFunctionLiteral@VIsolate@internal@v8@@@SharedFunctionInfo@internal@v8@@SAXPEAVIsolate@12@V?$Handle@VSharedFunctionInfo@internal@v8@@@12@PEAVFunctionLiteral@12@_N@Z	77	0x1407d60d0
??$InitFromFunctionLiteral@VLocalIsolate@internal@v8@@@SharedFunctionInfo@internal@v8@@SAXPEAVLocalIsolate@12@V?$Handle@VSharedFunctionInfo@internal@v8@@@12@PEAVFunctionLiteral@12@_N@Z	78	0x1407d6500
??$InitLineEnds@VIsolate@internal@v8@@@Script@internal@v8@@SAXPEAVIsolate@12@V?$Handle@VScript@internal@v8@@@12@@Z	79	0x1407ea9f0
??$InitLineEnds@VLocalIsolate@internal@v8@@@Script@internal@v8@@SAXPEAVLocalIsolate@12@V?$Handle@VScript@internal@v8@@@12@@Z	80	0x1407eab10
??$Initialize@VIsolate@internal@v8@@@SwissNameDictionary@internal@v8@@QEAAXPEAVIsolate@12@VByteArray@12@H@Z	81	0x1407bfb90
??$Initialize@VLocalIsolate@internal@v8@@@SwissNameDictionary@internal@v8@@QEAAXPEAVLocalIsolate@12@VByteArray@12@H@Z	82	0x1407bfce0
??$Internalize@VIsolate@internal@v8@@@AstRawString@internal@v8@@QEAAXPEAVIsolate@12@@Z	83	0x140affbb0
??$Internalize@VIsolate@internal@v8@@@AstValueFactory@internal@v8@@QEAAXPEAVIsolate@12@@Z	84	0x140affc70
??$Internalize@VLocalIsolate@internal@v8@@@AstRawString@internal@v8@@QEAAXPEAVLocalIsolate@12@@Z	85	0x140affda0
??$Internalize@VLocalIsolate@internal@v8@@@AstValueFactory@internal@v8@@QEAAXPEAVLocalIsolate@12@@Z	86	0x140affe60
??$InternalizeStringWithKey@V?$SeqSubStringKey@VSeqOneByteString@internal@v8@@@internal@v8@@@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VString@internal@v8@@@12@PEAV?$SeqSubStringKey@VSeqOneByteString@internal@v8@@@12@@Z	87	0x1409dfe40
??$InternalizeStringWithKey@V?$SeqSubStringKey@VSeqTwoByteString@internal@v8@@@internal@v8@@@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VString@internal@v8@@@12@PEAV?$SeqSubStringKey@VSeqTwoByteString@internal@v8@@@12@@Z	88	0x1409dfe70
??$InternalizeStringWithKey@V?$SequentialStringKey@E@internal@v8@@@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VString@internal@v8@@@12@PEAV?$SequentialStringKey@E@12@@Z	89	0x1409dfea0
??$InternalizeStringWithKey@V?$SequentialStringKey@E@internal@v8@@@?$FactoryBase@VLocalFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VString@internal@v8@@@12@PEAV?$SequentialStringKey@E@12@@Z	90	0x1409dfed0
??$InternalizeStringWithKey@V?$SequentialStringKey@G@internal@v8@@@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VString@internal@v8@@@12@PEAV?$SequentialStringKey@G@12@@Z	91	0x1409dff00
??$InternalizeStringWithKey@V?$SequentialStringKey@G@internal@v8@@@?$FactoryBase@VLocalFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VString@internal@v8@@@12@PEAV?$SequentialStringKey@G@12@@Z	92	0x1409dff30
??$MakeCheckOpString@HH@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HHPEBD@Z	93	0x140e5c840
??$MakeCheckOpString@II@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IIPEBD@Z	94	0x140e5cb20
??$MakeCheckOpString@JJ@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@JJPEBD@Z	95	0x140e5ce00
??$MakeCheckOpString@KK@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KKPEBD@Z	96	0x140e5d0e0
??$MakeCheckOpString@PEBXPEBX@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBX0PEBD@Z	97	0x140e5d3c0
??$MakeCheckOpString@_J_J@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J0PEBD@Z	98	0x140e5d6a0
??$MakeCheckOpString@_K_K@base@v8@@YAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K0PEBD@Z	99	0x140e5d990
??$New@VIsolate@internal@v8@@@?$BaseNameDictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	100	0x1407eaca0
??$New@VIsolate@internal@v8@@@?$BaseNameDictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	101	0x1407eacf0
??$New@VIsolate@internal@v8@@@?$HashTable@VCompilationCacheTable@internal@v8@@VCompilationCacheShape@23@@internal@v8@@SA?AV?$Handle@VCompilationCacheTable@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	102	0x1407ead40
??$New@VIsolate@internal@v8@@@?$HashTable@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VEphemeronHashTable@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	103	0x1407eae00
??$New@VIsolate@internal@v8@@@?$HashTable@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	104	0x1407eaec0
??$New@VIsolate@internal@v8@@@?$HashTable@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	105	0x1407eaf80
??$New@VIsolate@internal@v8@@@?$HashTable@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	106	0x1407eb040
??$New@VIsolate@internal@v8@@@?$HashTable@VObjectHashSet@internal@v8@@VObjectHashSetShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashSet@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	107	0x1407eb100
??$New@VIsolate@internal@v8@@@?$HashTable@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashTable@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	108	0x1407eb1c0
??$New@VIsolate@internal@v8@@@?$HashTable@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	109	0x1407eb280
??$New@VIsolate@internal@v8@@@?$HashTable@VStringSet@internal@v8@@VStringSetShape@23@@internal@v8@@SA?AV?$Handle@VStringSet@internal@v8@@@12@PEAVIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	110	0x1407eb100
??$New@VLocalIsolate@internal@v8@@@?$BaseNameDictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	111	0x1407eb340
??$New@VLocalIsolate@internal@v8@@@?$BaseNameDictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	112	0x1407eb390
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VCompilationCacheTable@internal@v8@@VCompilationCacheShape@23@@internal@v8@@SA?AV?$Handle@VCompilationCacheTable@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	113	0x1407eb3e0
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VEphemeronHashTable@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	114	0x1407eb4a0
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	115	0x1407eb560
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	116	0x1407eb620
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	117	0x1407eb6f0
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VObjectHashSet@internal@v8@@VObjectHashSetShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashSet@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	118	0x1407eb7b0
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@SA?AV?$Handle@VObjectHashTable@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	119	0x1407eb870
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	120	0x1407eb930
??$New@VLocalIsolate@internal@v8@@@?$HashTable@VStringSet@internal@v8@@VStringSetShape@23@@internal@v8@@SA?AV?$Handle@VStringSet@internal@v8@@@12@PEAVLocalIsolate@12@HW4AllocationType@12@W4MinimumCapacity@12@@Z	121	0x1407eb7b0
??$NewHeapNumber@$00@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VHeapNumber@internal@v8@@@12@XZ	122	0x1409dff60
??$NewHeapNumber@$00@?$FactoryBase@VLocalFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VHeapNumber@internal@v8@@@12@XZ	123	0x1409e0000
??$NewHeapNumber@$03@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VHeapNumber@internal@v8@@@12@XZ	124	0x1409e00b0
??$NewHeapNumber@$0A@@?$FactoryBase@VFactory@internal@v8@@@internal@v8@@QEAA?AV?$Handle@VHeapNumber@internal@v8@@@12@XZ	125	0x1409e0150
??$PrepareErrors@VIsolate@internal@v8@@@PendingCompilationErrorHandler@internal@v8@@QEAAXPEAVIsolate@12@PEAVAstValueFactory@12@@Z	126	0x1407a22c0
??$PrepareErrors@VLocalIsolate@internal@v8@@@PendingCompilationErrorHandler@internal@v8@@QEAAXPEAVLocalIsolate@12@PEAVAstValueFactory@12@@Z	127	0x1407a2300
??$PrintCheckOperand@C@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@C@Z	128	0x140e5dc80
??$PrintCheckOperand@D@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@Z	129	0x140e5dc80
??$PrintCheckOperand@E@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z	130	0x140e5dca0
??$PrintCheckOperand@H@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z	131	0x140e5dcc0
??$PrintCheckOperand@I@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z	132	0x140e5de00
??$PrintCheckOperand@J@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@J@Z	133	0x140e5df40
??$PrintCheckOperand@K@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@K@Z	134	0x140e5df60
??$PrintCheckOperand@PEAC@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAC@Z	135	0x140e5df80
??$PrintCheckOperand@PEAD@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAD@Z	136	0x140e5df80
??$PrintCheckOperand@PEAE@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z	137	0x140e5df80
??$PrintCheckOperand@PEBC@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBC@Z	138	0x140e5df80
??$PrintCheckOperand@PEBD@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z	139	0x140e5df80
??$PrintCheckOperand@PEBE@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBE@Z	140	0x140e5df80
??$PrintCheckOperand@PEBX@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBX@Z	141	0x140e5dfa0
??$PrintCheckOperand@_J@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z	142	0x140e5e0e0
??$PrintCheckOperand@_K@base@v8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z	143	0x140e5e100
??$ReadZigZag@H@ValueDeserializer@internal@v8@@AEAA?AV?$Maybe@H@2@XZ	144	0x1407b38f0
??$RegisterObjectWithInvalidatedSlots@$00@MemoryChunk@internal@v8@@QEAAXVHeapObject@12@@Z	145	0x140972e00
??$RegisterObjectWithInvalidatedSlots@$0A@@MemoryChunk@internal@v8@@QEAAXVHeapObject@12@@Z	146	0x140972ea0
??$Rehash@VIsolate@internal@v8@@@OrderedNameDictionary@internal@v8@@SA?AV?$MaybeHandle@VOrderedNameDictionary@internal@v8@@@12@PEAVIsolate@12@V?$Handle@VOrderedNameDictionary@internal@v8@@@12@H@Z	147	0x1407e1a90
??$Rehash@VIsolate@internal@v8@@@SwissNameDictionary@internal@v8@@QEAAXPEAVIsolate@12@@Z	148	0x1407bfe30
??$Rehash@VIsolate@internal@v8@@@SwissNameDictionary@internal@v8@@SA?AV?$Handle@VSwissNameDictionary@internal@v8@@@12@PEAVIsolate@12@V312@H@Z	149	0x1407c0280
??$Rehash@VLocalIsolate@internal@v8@@@SwissNameDictionary@internal@v8@@QEAAXPEAVLocalIsolate@12@@Z	150	0x1407c0650
??$Rehash@VLocalIsolate@internal@v8@@@SwissNameDictionary@internal@v8@@SA?AV?$Handle@VSwissNameDictionary@internal@v8@@@12@PEAVLocalIsolate@12@V312@H@Z	151	0x1407c0aa0
??$SignedDivisionByConstant@I@base@v8@@YA?AU?$MagicNumbersForDivision@I@01@I@Z	152	0x1410ee000
??$SignedDivisionByConstant@_K@base@v8@@YA?AU?$MagicNumbersForDivision@_K@01@_K@Z	153	0x1410ee100
??$Start@$00@LookupIterator@internal@v8@@AEAAXXZ	154	0x14081b820
??$Start@$0A@@LookupIterator@internal@v8@@AEAAXXZ	155	0x14081b8d0
??$TailCallBytecodeDispatch@V?$TNode@VObject@internal@v8@@@internal@v8@@V?$TNode@UIntPtrT@internal@v8@@@23@V?$TNode@VBytecodeArray@internal@v8@@@23@V?$TNode@VExternalReference@internal@v8@@@23@@CodeAssembler@compiler@internal@v8@@QEAAXAEBVCallInterfaceDescriptor@23@V?$TNode@URawPtrT@internal@v8@@@23@V?$TNode@VObject@internal@v8@@@23@V?$TNode@UIntPtrT@internal@v8@@@23@V?$TNode@VBytecodeArray@internal@v8@@@23@V?$TNode@VExternalReference@internal@v8@@@23@@Z	156	0x140f1c560
??$ToBytecodeArray@VIsolate@internal@v8@@@BytecodeArrayBuilder@interpreter@internal@v8@@QEAA?AV?$Handle@VBytecodeArray@internal@v8@@@23@PEAVIsolate@23@@Z	157	0x140918dc0
??$ToBytecodeArray@VIsolate@internal@v8@@@BytecodeArrayWriter@interpreter@internal@v8@@QEAA?AV?$Handle@VBytecodeArray@internal@v8@@@23@PEAVIsolate@23@HHV?$Handle@VByteArray@internal@v8@@@23@@Z	158	0x140911fb0
??$ToBytecodeArray@VLocalIsolate@internal@v8@@@BytecodeArrayBuilder@interpreter@internal@v8@@QEAA?AV?$Handle@VBytecodeArray@internal@v8@@@23@PEAVLocalIsolate@23@@Z	159	0x140918e60
??$ToBytecodeArray@VLocalIsolate@internal@v8@@@BytecodeArrayWriter@interpreter@internal@v8@@QEAA?AV?$Handle@VBytecodeArray@internal@v8@@@23@PEAVLocalIsolate@23@HHV?$Handle@VByteArray@internal@v8@@@23@@Z	160	0x1409120a0
??$ToFixedArray@VIsolate@internal@v8@@@ConstantArrayBuilder@interpreter@internal@v8@@QEAA?AV?$Handle@VFixedArray@internal@v8@@@23@PEAVIsolate@23@@Z	161	0x1408f4240
??$ToFixedArray@VLocalIsolate@internal@v8@@@ConstantArrayBuilder@interpreter@internal@v8@@QEAA?AV?$Handle@VFixedArray@internal@v8@@@23@PEAVLocalIsolate@23@@Z	162	0x1408f4470
??$ToSourcePositionTable@VIsolate@internal@v8@@@BytecodeArrayBuilder@interpreter@internal@v8@@QEAA?AV?$Handle@VByteArray@internal@v8@@@23@PEAVIsolate@23@@Z	163	0x140918f00
??$ToSourcePositionTable@VIsolate@internal@v8@@@BytecodeArrayWriter@interpreter@internal@v8@@QEAA?AV?$Handle@VByteArray@internal@v8@@@23@PEAVIsolate@23@@Z	164	0x140912190
??$ToSourcePositionTable@VIsolate@internal@v8@@@SourcePositionTableBuilder@internal@v8@@QEAA?AV?$Handle@VByteArray@internal@v8@@@12@PEAVIsolate@12@@Z	165	0x140a7ee10
??$ToSourcePositionTable@VLocalIsolate@internal@v8@@@BytecodeArrayBuilder@interpreter@internal@v8@@QEAA?AV?$Handle@VByteArray@internal@v8@@@23@PEAVLocalIsolate@23@@Z	166	0x140918f20
??$ToSourcePositionTable@VLocalIsolate@internal@v8@@@BytecodeArrayWriter@interpreter@internal@v8@@QEAA?AV?$Handle@VByteArray@internal@v8@@@23@PEAVLocalIsolate@23@@Z	167	0x1409121d0
??$ToSourcePositionTable@VLocalIsolate@internal@v8@@@SourcePositionTableBuilder@internal@v8@@QEAA?AV?$Handle@VByteArray@internal@v8@@@12@PEAVLocalIsolate@12@@Z	168	0x140a7ee90
??$UnsignedDivisionByConstant@I@base@v8@@YA?AU?$MagicNumbersForDivision@I@01@II@Z	169	0x1410ee210
??$UnsignedDivisionByConstant@_K@base@v8@@YA?AU?$MagicNumbersForDivision@_K@01@_KI@Z	170	0x1410ee340
??$WriteBarrierForRange@VFullObjectSlot@internal@v8@@@Heap@internal@v8@@QEAAXVHeapObject@12@VFullObjectSlot@12@1@Z	171	0x1409aaac0
??$WriteToFlat@E@String@internal@v8@@SAXV012@PEAEHH@Z	172	0x1407c2cf0
??$WriteToFlat@E@String@internal@v8@@SAXV012@PEAEHHAEBVSharedStringAccessGuardIfNeeded@12@@Z	173	0x1407c2d30
??$WriteToFlat@G@String@internal@v8@@SAXV012@PEAGHH@Z	174	0x1407c3070
??$WriteToFlat@G@String@internal@v8@@SAXV012@PEAGHHAEBVSharedStringAccessGuardIfNeeded@12@@Z	175	0x1407c30b0
??$WriteZigZag@H@ValueSerializer@internal@v8@@AEAAXH@Z	176	0x1407b3a50
??0?$BaseNameDictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@IEAA@_K@Z	177	0x140078b40
??0?$BaseNameDictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@QEAA@XZ	178	0x1400fba60
??0?$BaseNameDictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@IEAA@_K@Z	179	0x140078b40
??0?$BaseNameDictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@QEAA@XZ	180	0x1400fba60
??0?$CombinationAssertScope@V?$PerThreadAssertScopeDebugOnly@$01$0A@@internal@v8@@V?$PerThreadAssertScopeDebugOnly@$00$0A@@23@@internal@v8@@QEAA@XZ	181	0x140078ac0
??0?$CombinationAssertScope@V?$PerThreadAssertScopeDebugOnly@$02$0A@@internal@v8@@V?$PerThreadAssertScopeDebugOnly@$01$0A@@23@V?$PerThreadAssertScopeDebugOnly@$00$0A@@23@@internal@v8@@QEAA@XZ	182	0x140078ac0
??0?$CombinationAssertScope@V?$PerThreadAssertScopeDebugOnly@$03$0A@@internal@v8@@V?$PerThreadAssertScopeDebugOnly@$02$0A@@23@V?$PerThreadAssertScopeDebugOnly@$01$0A@@23@V?$PerThreadAssertScopeDebugOnly@$00$0A@@23@@internal@v8@@QEAA@XZ	183	0x140078ac0
??0?$CombinationAssertScope@V?$PerThreadAssertScopeDebugOnly@$0A@$00@internal@v8@@V?$PerThreadAssertScopeDebugOnly@$00$00@23@@internal@v8@@QEAA@XZ	184	0x140078ac0
??0?$CombinationAssertScope@V?$PerThreadAssertScopeDebugOnly@$0A@$0A@@internal@v8@@V?$PerThreadAssertScopeDebugOnly@$00$0A@@23@@internal@v8@@QEAA@XZ	185	0x140078ac0
??0?$Deserializer@VIsolate@internal@v8@@@internal@v8@@IEAA@PEAVIsolate@12@V?$Vector@$$CBE@base@2@I_N2@Z	186	0x1406d5c20
??0?$Deserializer@VLocalIsolate@internal@v8@@@internal@v8@@IEAA@PEAVLocalIsolate@12@V?$Vector@$$CBE@base@2@I_N2@Z	187	0x1406d5e30
??0?$Dictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@IEAA@_K@Z	188	0x140078b40
??0?$Dictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@QEAA@XZ	189	0x1400fba60
??0?$Dictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@IEAA@_K@Z	190	0x140078b40
??0?$Dictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@QEAA@XZ	191	0x1400fba60
??0?$Dictionary@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@IEAA@_K@Z	192	0x140078b40
??0?$Dictionary@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@QEAA@XZ	193	0x1400fba60
??0?$Dictionary@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@IEAA@_K@Z	194	0x140078b40
??0?$Dictionary@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@QEAA@XZ	195	0x1400fba60
??0?$HashTable@VCompilationCacheTable@internal@v8@@VCompilationCacheShape@23@@internal@v8@@IEAA@_K@Z	196	0x140078b40
??0?$HashTable@VCompilationCacheTable@internal@v8@@VCompilationCacheShape@23@@internal@v8@@QEAA@XZ	197	0x1400fba60
??0?$HashTable@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@IEAA@_K@Z	198	0x140078b40
??0?$HashTable@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@QEAA@XZ	199	0x1400fba60
??0?$HashTable@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@IEAA@_K@Z	200	0x140078b40
??0?$HashTable@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@QEAA@XZ	201	0x1400fba60
??0?$HashTable@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@IEAA@_K@Z	202	0x140078b40
??0?$HashTable@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@QEAA@XZ	203	0x1400fba60
??0?$HashTable@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@IEAA@_K@Z	204	0x140078b40
??0?$HashTable@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@QEAA@XZ	205	0x1400fba60
??0?$HashTable@VObjectHashSet@internal@v8@@VObjectHashSetShape@23@@internal@v8@@IEAA@_K@Z	206	0x140078b40
??0?$HashTable@VObjectHashSet@internal@v8@@VObjectHashSetShape@23@@internal@v8@@QEAA@XZ	207	0x1400fba60
??0?$HashTable@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@IEAA@_K@Z	208	0x140078b40
??0?$HashTable@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@QEAA@XZ	209	0x1400fba60
??0?$HashTable@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@IEAA@_K@Z	210	0x140078b40
??0?$HashTable@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@QEAA@XZ	211	0x1400fba60
??0?$HashTable@VStringSet@internal@v8@@VStringSetShape@23@@internal@v8@@IEAA@_K@Z	212	0x140078b40
??0?$HashTable@VStringSet@internal@v8@@VStringSetShape@23@@internal@v8@@QEAA@XZ	213	0x1400fba60
??0?$MagicNumbersForDivision@I@base@v8@@QEAA@II_N@Z	214	0x1410ee4a0
??0?$MagicNumbersForDivision@_K@base@v8@@QEAA@_KI_N@Z	215	0x1410ee4b0
??0?$MemorySpan@$$CBD@v8@@QEAA@PEBD_K@Z	216	0x140450cf0
??0?$MemorySpan@$$CBD@v8@@QEAA@XZ	217	0x140079750
??0?$MemorySpan@$$CBE@v8@@QEAA@PEBE_K@Z	218	0x140450cf0
??0?$MemorySpan@$$CBE@v8@@QEAA@XZ	219	0x140079750
??0?$MemorySpan@$$CBVCFunction@v8@@@v8@@QEAA@PEBVCFunction@1@_K@Z	220	0x140450cf0
??0?$MemorySpan@$$CBVCFunction@v8@@@v8@@QEAA@XZ	221	0x140079750
??0?$ObjectHashTableBase@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@IEAA@_K@Z	222	0x140078b40
??0?$ObjectHashTableBase@VEphemeronHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@QEAA@XZ	223	0x1400fba60
??0?$ObjectHashTableBase@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@IEAA@_K@Z	224	0x140078b40
??0?$ObjectHashTableBase@VObjectHashTable@internal@v8@@VObjectHashTableShape@23@@internal@v8@@QEAA@XZ	225	0x1400fba60
??0?$OrderedHashTable@VOrderedHashMap@internal@v8@@$01@internal@v8@@IEAA@_K@Z	226	0x140078b40
??0?$OrderedHashTable@VOrderedHashMap@internal@v8@@$01@internal@v8@@QEAA@XZ	227	0x1400fba60
??0?$OrderedHashTable@VOrderedHashSet@internal@v8@@$00@internal@v8@@IEAA@_K@Z	228	0x140078b40
??0?$OrderedHashTable@VOrderedHashSet@internal@v8@@$00@internal@v8@@QEAA@XZ	229	0x1400fba60
??0?$OrderedHashTable@VOrderedNameDictionary@internal@v8@@$02@internal@v8@@IEAA@_K@Z	230	0x140078b40
??0?$OrderedHashTable@VOrderedNameDictionary@internal@v8@@$02@internal@v8@@QEAA@XZ	231	0x1400fba60
??0?$ParserBase@VParser@internal@v8@@@internal@v8@@QEAA@PEAVZone@12@PEAVScanner@12@_KPEAVAstValueFactory@12@PEAVPendingCompilationErrorHandler@12@PEAVRuntimeCallStats@12@PEAVLogger@12@VUnoptimizedCompileFlags@12@_N@Z	232	0x140772280
??0?$PerThreadAssertScope@$00$00@internal@v8@@QEAA@XZ	233	0x140a7d4f0
??0?$PerThreadAssertScope@$00$0A@@internal@v8@@QEAA@XZ	234	0x140a7d520
??0?$PerThreadAssertScope@$01$00@internal@v8@@QEAA@XZ	235	0x140a7d550
??0?$PerThreadAssertScope@$01$0A@@internal@v8@@QEAA@XZ	236	0x140a7d580
??0?$PerThreadAssertScope@$02$00@internal@v8@@QEAA@XZ	237	0x140a7d5b0
??0?$PerThreadAssertScope@$02$0A@@internal@v8@@QEAA@XZ	238	0x140a7d5e0
??0?$PerThreadAssertScope@$03$00@internal@v8@@QEAA@XZ	239	0x140a7d610
??0?$PerThreadAssertScope@$03$0A@@internal@v8@@QEAA@XZ	240	0x140a7d640
??0?$PerThreadAssertScope@$04$00@internal@v8@@QEAA@XZ	241	0x140a7d670
??0?$PerThreadAssertScope@$04$0A@@internal@v8@@QEAA@XZ	242	0x140a7d6a0
??0?$PerThreadAssertScope@$05$0A@@internal@v8@@QEAA@XZ	243	0x140a7d6d0
??0?$PerThreadAssertScope@$0A@$00@internal@v8@@QEAA@XZ	244	0x140a7d700
??0?$PerThreadAssertScope@$0A@$0A@@internal@v8@@QEAA@XZ	245	0x140a7d730
??0?$StaticCallInterfaceDescriptor@VBigIntToI32PairDescriptor@internal@v8@@@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	246	0x1404b9be0
??0?$StaticCallInterfaceDescriptor@VBigIntToI64Descriptor@internal@v8@@@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	247	0x1404b9be0
??0?$StaticCallInterfaceDescriptor@VI32PairToBigIntDescriptor@internal@v8@@@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	248	0x1404b9be0
??0?$StaticCallInterfaceDescriptor@VI64ToBigIntDescriptor@internal@v8@@@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	249	0x1404b9be0
??0?$StaticCallInterfaceDescriptor@VInterpreterDispatchDescriptor@internal@v8@@@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	250	0x1404b9be0
??0?$StaticCallInterfaceDescriptor@VVoidDescriptor@internal@v8@@@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	251	0x1404b9be0
??0?$TimeBase@VThreadTicks@base@v8@@@time_internal@base@v8@@IEAA@_J@Z	252	0x140078b40
??0?$TimeBase@VTime@base@v8@@@time_internal@base@v8@@IEAA@_J@Z	253	0x140078b40
??0?$TimeBase@VTimeTicks@base@v8@@@time_internal@base@v8@@IEAA@_J@Z	254	0x140078b40
??0?$ZoneVector@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@QEAA@AEBV012@@Z	255	0x1404b9c20
??0?$ZoneVector@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@QEAA@PEAVZone@12@@Z	256	0x1404b9c40
??0?$ZoneVector@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@QEAA@V?$initializer_list@PEAVMoveOperands@compiler@internal@v8@@@std@@PEAVZone@12@@Z	257	0x1404b9c60
??0?$ZoneVector@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@QEAA@_KPEAVMoveOperands@compiler@12@PEAVZone@12@@Z	258	0x1404b9cf0
??0?$ZoneVector@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@QEAA@_KPEAVZone@12@@Z	259	0x1404b9d60
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ	260	0x14047b990
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z	261	0x14047b9b0
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z	262	0x14047b9f0
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z	263	0x1400f8660
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z	264	0x14047baa0
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@AEBV01@@Z	265	0x14047bb20
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@W4_Uninitialized@1@@Z	266	0x14047bc30
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ	267	0x1400ef780
??0?$enable_shared_from_this@VCounters@V8Inspector@v8_inspector@@@std@@IEAA@AEBV01@@Z	268	0x140079750
??0?$enable_shared_from_this@VCounters@V8Inspector@v8_inspector@@@std@@IEAA@XZ	269	0x140079750
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@$$QEAV01@@Z	270	0x1404b9e80
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@$$QEAV01@AEBV?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@@Z	271	0x1404b9eb0
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@AEBV01@@Z	272	0x1404b9ee0
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@AEBV01@AEBV?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@@Z	273	0x1404b9fa0
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@AEBV?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@@Z	274	0x1404ba060
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@V?$initializer_list@PEAVMoveOperands@compiler@internal@v8@@@1@AEBV?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@@Z	275	0x1404ba080
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@XZ	276	0x1404ba100
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@_KAEBQEAVMoveOperands@compiler@internal@v8@@AEBV?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@45@@Z	277	0x1404ba110
??0?$vector@PEAVMoveOperands@compiler@internal@v8@@V?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@34@@std@@QEAA@_KAEBV?$ZoneAllocator@PEAVMoveOperands@compiler@internal@v8@@@internal@v8@@@Z	278	0x1404ba180
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@$$QEAV01@@Z	279	0x14007b4c0
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@$$QEAV01@AEBV?$allocator@UCpuProfileDeoptFrame@v8@@@1@@Z	280	0x14007b480
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@AEBV01@@Z	281	0x14007c530
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@AEBV01@AEBV?$allocator@UCpuProfileDeoptFrame@v8@@@1@@Z	282	0x14007c530
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@AEBV?$allocator@UCpuProfileDeoptFrame@v8@@@1@@Z	283	0x14007b730
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@V?$initializer_list@UCpuProfileDeoptFrame@v8@@@1@AEBV?$allocator@UCpuProfileDeoptFrame@v8@@@1@@Z	284	0x14007c5c0
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@XZ	285	0x14007b730
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@_KAEBUCpuProfileDeoptFrame@v8@@AEBV?$allocator@UCpuProfileDeoptFrame@v8@@@1@@Z	286	0x14007c660
??0?$vector@UCpuProfileDeoptFrame@v8@@V?$allocator@UCpuProfileDeoptFrame@v8@@@std@@@std@@QEAA@_KAEBV?$allocator@UCpuProfileDeoptFrame@v8@@@1@@Z	287	0x14007c6e0
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@$$QEAV01@@Z	288	0x14007b4c0
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@$$QEAV01@AEBV?$allocator@UCpuProfileDeoptInfo@v8@@@1@@Z	289	0x14007b480
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@AEBV01@@Z	290	0x14007b520
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@AEBV01@AEBV?$allocator@UCpuProfileDeoptInfo@v8@@@1@@Z	291	0x14007b520
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@AEBV?$allocator@UCpuProfileDeoptInfo@v8@@@1@@Z	292	0x14007b730
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@V?$initializer_list@UCpuProfileDeoptInfo@v8@@@1@AEBV?$allocator@UCpuProfileDeoptInfo@v8@@@1@@Z	293	0x14007b590
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@XZ	294	0x14007b730
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@_KAEBUCpuProfileDeoptInfo@v8@@AEBV?$allocator@UCpuProfileDeoptInfo@v8@@@1@@Z	295	0x14007b610
??0?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@QEAA@_KAEBV?$allocator@UCpuProfileDeoptInfo@v8@@@1@@Z	296	0x14007b680
??0AccountingAllocator@internal@v8@@QEAA@XZ	297	0x1406abec0
??0ActivityControl@v8@@QEAA@AEBV01@@Z	298	0x140079fd0
??0ActivityControl@v8@@QEAA@XZ	299	0x140079fd0
??0AddTypeAssertionsReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVZone@23@@Z	300	0x140f6cc70
??0AddressToTraceMap@internal@v8@@QEAA@$$QEAV012@@Z	301	0x140751b70
??0AddressToTraceMap@internal@v8@@QEAA@AEBV012@@Z	302	0x140751bd0
??0AddressToTraceMap@internal@v8@@QEAA@XZ	303	0x140751c30
??0AlignedSlotAllocator@internal@v8@@QEAA@XZ	304	0x1404ba1f0
??0AllocationProfile@v8@@QEAA@AEBV01@@Z	305	0x14007a080
??0AllocationProfile@v8@@QEAA@XZ	306	0x14007a080
??0Allocator@ArrayBuffer@v8@@QEAA@AEBV012@@Z	307	0x1400796d0
??0Allocator@ArrayBuffer@v8@@QEAA@XZ	308	0x1400796d0
??0AllowCompilation@internal@v8@@QEAA@PEAVIsolate@12@@Z	309	0x140a7d760
??0AllowDeoptimization@internal@v8@@QEAA@PEAVIsolate@12@@Z	310	0x140a7d780
??0AllowExceptions@internal@v8@@QEAA@PEAVIsolate@12@@Z	311	0x140a7d7a0
??0AllowJavascriptExecution@internal@v8@@QEAA@PEAVIsolate@12@@Z	312	0x140a7d7c0
??0AllowJavascriptExecutionScope@Isolate@v8@@QEAA@PEAV12@@Z	313	0x140b06380
??0ArrayBufferAllocator@node@@QEAA@$$QEAV01@@Z	314	0x14007a110
??0ArrayBufferAllocator@node@@QEAA@AEBV01@@Z	315	0x14007a110
??0ArrayBufferAllocator@node@@QEAA@XZ	316	0x14007a110
??0AsmCallableType@wasm@internal@v8@@IEAA@XZ	317	0x140631fc0
??0AsmFunctionType@wasm@internal@v8@@IEAA@PEAVZone@23@PEAVAsmType@123@@Z	318	0x140631fd0
??0AsmJsOffsetInformation@wasm@internal@v8@@QEAA@V?$Vector@$$CBE@base@3@@Z	319	0x140538110
??0AsmJsScanner@internal@v8@@QEAA@$$QEAV012@@Z	320	0x140634670
??0AsmJsScanner@internal@v8@@QEAA@AEBV012@@Z	321	0x140634760
??0AsmJsScanner@internal@v8@@QEAA@PEAVUtf16CharacterStream@12@@Z	322	0x140634830
??0AsmOverloadedFunctionType@wasm@internal@v8@@AEAA@PEAVZone@23@@Z	323	0x140632000
??0Assembler@internal@v8@@QEAA@AEBUAssemblerOptions@12@V?$unique_ptr@VAssemblerBuffer@internal@v8@@U?$default_delete@VAssemblerBuffer@internal@v8@@@std@@@std@@@Z	324	0x14050bda0
??0AssemblerBase@internal@v8@@QEAA@AEBUAssemblerOptions@12@V?$unique_ptr@VAssemblerBuffer@internal@v8@@U?$default_delete@VAssemblerBuffer@internal@v8@@@std@@@std@@@Z	325	0x140ab3a00
??0AssemblerOptions@internal@v8@@QEAA@XZ	326	0x14049b010
??0AsyncResource@node@@QEAA@PEAVIsolate@v8@@V?$Local@VObject@v8@@@3@PEBDN@Z	327	0x1402907b0
??0AsyncStreamingDecoder@wasm@internal@v8@@QEAA@V?$unique_ptr@VStreamingProcessor@wasm@internal@v8@@U?$default_delete@VStreamingProcessor@wasm@internal@v8@@@std@@@std@@@Z	328	0x140571310
??0BackgroundCompileTask@internal@v8@@QEAA@PEAUScriptStreamingData@12@PEAVIsolate@12@W4ScriptType@2@@Z	329	0x140aa5bb0
??0BackgroundCompileTask@internal@v8@@QEAA@PEBVParseInfo@12@PEBVAstRawString@12@PEBVFunctionLiteral@12@PEAVWorkerThreadRuntimeCallStats@12@PEAVTimedHistogram@12@H@Z	330	0x140aa5d60
??0BackingStore@internal@v8@@AEAA@PEAX_K11W4SharedFlag@12@W4ResizableFlag@12@_N4444@Z	331	0x14047bcd0
??0BackupIncumbentScope@Context@v8@@QEAA@V?$Local@VContext@v8@@@2@@Z	332	0x140b063d0
??0BasePage@internal@cppgc@@IEAA@AEAVHeapBase@12@AEAVBaseSpace@12@W4PageType@012@@Z	333	0x140464680
??0BaseSpace@internal@cppgc@@IEAA@PEAVRawHeap@12@_KW4PageType@012@_N@Z	334	0x140464460
??0BaseSpace@internal@v8@@IEAA@PEAVHeap@12@W4AllocationSpace@12@@Z	335	0x14047bd50
??0BasicBlock@compiler@internal@v8@@QEAA@PEAVZone@23@VId@0123@@Z	336	0x140ee11a0
??0BasicBlockProfilerData@internal@v8@@QEAA@V?$Handle@VOnHeapBasicBlockProfilerData@internal@v8@@@12@PEAVIsolate@12@@Z	337	0x140a459f0
??0BasicBlockProfilerData@internal@v8@@QEAA@VOnHeapBasicBlockProfilerData@12@@Z	338	0x140a45a60
??0BigIntToI32PairDescriptor@internal@v8@@IEAA@W4Key@CallDescriptors@12@@Z	339	0x1404b9be0
??0BigIntToI32PairDescriptor@internal@v8@@QEAA@XZ	340	0x1404ba210
??0BigIntToI64Descriptor@internal@v8@@IEAA@W4Key@CallDescriptors@12@@Z	341	0x1404b9be0
??0BigIntToI64Descriptor@internal@v8@@QEAA@XZ	342	0x1404ba220
??0Bignum@base@v8@@QEAA@XZ	343	0x140e6f6c0
??0Binary@protocol@v8_inspector@@AEAA@V?$shared_ptr@V?$vector@EV?$allocator@E@std@@@std@@@std@@@Z	344	0x14042dcf0
??0Binary@protocol@v8_inspector@@QEAA@$$QEAV012@@Z	345	0x14042dd80
??0Binary@protocol@v8_inspector@@QEAA@AEBV012@@Z	346	0x14042ddb0
??0Binary@protocol@v8_inspector@@QEAA@XZ	347	0x140079750
??0BitVector@internal@v8@@QEAA@AEBV012@PEAVZone@12@@Z	348	0x1404ba230
??0BitVector@internal@v8@@QEAA@HPEAVZone@12@@Z	349	0x1404ba2d0
??0BitVector@internal@v8@@QEAA@XZ	350	0x1404ba3a0
??0BlockBuilder@interpreter@internal@v8@@QEAA@PEAVBytecodeArrayBuilder@123@PEAVBlockCoverageBuilder@123@PEAVBreakableStatement@23@@Z	351	0x1408f2780
??0BlockData@Coverage@debug@v8@@AEAA@PEAUCoverageBlock@internal@3@V?$shared_ptr@VCoverage@internal@v8@@@std@@@Z	352	0x14047bd70
??0BlockData@Coverage@debug@v8@@QEAA@$$QEAV0123@@Z	353	0x14047bda0
??0BookmarkScope@Scanner@internal@v8@@QEAA@PEAV123@@Z	354	0x14047bdd0
??0BoundedPageAllocator@base@v8@@QEAA@PEAVPageAllocator@2@_K11@Z	355	0x140e68850
??0BranchElimination@compiler@internal@v8@@QEAA@AEBV0123@@Z	356	0x140f096f0
??0BranchElimination@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVZone@23@W4Phase@0123@@Z	357	0x140f8e490
??0BranchHintMap@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	358	0x14047bdf0
??0BranchHintMap@wasm@internal@v8@@QEAA@AEBV0123@@Z	359	0x14047bed0
??0BranchHintMap@wasm@internal@v8@@QEAA@XZ	360	0x14045ac30
??0BranchMatcher@compiler@internal@v8@@QEAA@PEAVNode@123@@Z	361	0x141099100
??0BreakIterator@internal@v8@@QEAA@V?$Handle@VDebugInfo@internal@v8@@@12@@Z	362	0x140a5c690
??0BreakLocation@debug@v8@@QEAA@HHW4BreakLocationType@12@@Z	363	0x14047bf60
??0BreakableControlFlowBuilder@interpreter@internal@v8@@QEAA@PEAVBytecodeArrayBuilder@123@PEAVBlockCoverageBuilder@123@PEAVAstNode@23@@Z	364	0x1408f27b0
??0ByteData@PreparseDataBuilder@internal@v8@@QEAA@XZ	365	0x14047bf90
??0BytecodeAnalysis@compiler@internal@v8@@QEAA@V?$Handle@VBytecodeArray@internal@v8@@@23@PEAVZone@23@VBytecodeOffset@23@_N@Z	366	0x141096f70
??0BytecodeArrayBuilder@interpreter@internal@v8@@QEAA@PEAVZone@23@HHPEAVFeedbackVectorSpec@23@W4RecordingMode@SourcePositionTableBuilder@23@@Z	367	0x140918f40
??0BytecodeArrayIterator@interpreter@internal@v8@@QEAA@V?$Handle@VBytecodeArray@internal@v8@@@23@H@Z	368	0x1409135f0
??0BytecodeArrayRandomIterator@interpreter@internal@v8@@QEAA@V?$Handle@VBytecodeArray@internal@v8@@@23@PEAVZone@23@@Z	369	0x140913030
??0BytecodeArrayWriter@interpreter@internal@v8@@QEAA@PEAVZone@23@PEAVConstantArrayBuilder@123@W4RecordingMode@SourcePositionTableBuilder@23@@Z	370	0x140912210
??0BytecodeIterator@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	371	0x1405235c0
??0BytecodeIterator@wasm@internal@v8@@QEAA@AEBV0123@@Z	372	0x1405235c0
??0BytecodeIterator@wasm@internal@v8@@QEAA@PEBE0PEAUBodyLocalDecls@123@@Z	373	0x1405c2700
??0BytecodeJumpTable@interpreter@internal@v8@@QEAA@_KHHPEAVZone@23@@Z	374	0x1408f2840
??0BytecodeLabel@interpreter@internal@v8@@QEAA@XZ	375	0x1408f0560
??0BytecodeLabels@interpreter@internal@v8@@QEAA@PEAVZone@23@@Z	376	0x1408f0570
??0BytecodeLivenessMap@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	377	0x140f91980
??0BytecodeLivenessMap@compiler@internal@v8@@QEAA@HPEAVZone@23@@Z	378	0x141096b90
??0BytecodeLoopAssignments@compiler@internal@v8@@QEAA@HHPEAVZone@23@@Z	379	0x1410971f0
??0BytecodeLoopHeader@interpreter@internal@v8@@QEAA@XZ	380	0x1408f05d0
??0BytecodeNode@interpreter@internal@v8@@AEAA@W4Bytecode@123@HW4OperandScale@123@VBytecodeSourceInfo@123@IIIII@Z	381	0x1408f8ee0
??0BytecodeNode@interpreter@internal@v8@@QEAA@W4Bytecode@123@IIIIIVBytecodeSourceInfo@123@@Z	382	0x1408f8f20
??0BytecodeNode@interpreter@internal@v8@@QEAA@W4Bytecode@123@IIIIVBytecodeSourceInfo@123@@Z	383	0x1408f91e0
??0BytecodeNode@interpreter@internal@v8@@QEAA@W4Bytecode@123@IIIVBytecodeSourceInfo@123@@Z	384	0x1408f9420
??0BytecodeNode@interpreter@internal@v8@@QEAA@W4Bytecode@123@IIVBytecodeSourceInfo@123@@Z	385	0x1408f95e0
??0BytecodeNode@interpreter@internal@v8@@QEAA@W4Bytecode@123@IVBytecodeSourceInfo@123@@Z	386	0x1408f9720
??0BytecodeNode@interpreter@internal@v8@@QEAA@W4Bytecode@123@VBytecodeSourceInfo@123@@Z	387	0x1408f9800
??0BytecodeOffsetIterator@baseline@internal@v8@@QEAA@V?$Handle@VByteArray@internal@v8@@@23@V?$Handle@VBytecodeArray@internal@v8@@@23@@Z	388	0x140ae5880
??0BytecodeOffsetIterator@baseline@internal@v8@@QEAA@VByteArray@23@VBytecodeArray@23@@Z	389	0x140ae5920
??0BytecodeRegisterOptimizer@interpreter@internal@v8@@QEAA@PEAVZone@23@PEAVBytecodeRegisterAllocator@123@HHPEAVBytecodeWriter@0123@@Z	390	0x1408f7a90
??0CFunction@v8@@QEAA@PEBXPEBVCFunctionInfo@1@@Z	391	0x140b06420
??0CFunction@v8@@QEAA@XZ	392	0x140079750
??0CFunctionInfo@v8@@QEAA@AEBVCTypeInfo@1@IPEBV21@@Z	393	0x140b06470
??0CPU@base@v8@@QEAA@XZ	394	0x140e63810
??0CachedData@ScriptCompiler@v8@@QEAA@PEBEHW4BufferPolicy@012@@Z	395	0x140b06490
??0CachedData@ScriptCompiler@v8@@QEAA@XZ	396	0x140078b20
??0CallDescriptor@compiler@internal@v8@@QEAA@W4Kind@0123@VMachineType@23@VLinkageLocation@123@PEAV?$Signature@VLinkageLocation@compiler@internal@v8@@@23@_KV?$Flags@W4Property@Operator@compiler@internal@v8@@E@base@3@IIV?$Flags@W4Flag@CallDescriptor@compiler@internal@v8@@H@93@PEBDW4StackArgumentOrder@23@I4@Z	397	0x1404ba3c0
??0CallInterfaceDescriptor@internal@v8@@QEAA@W4Key@CallDescriptors@12@@Z	398	0x1404b9be0
??0CallInterfaceDescriptor@internal@v8@@QEAA@XZ	399	0x1400fba60
??0CallInterfaceDescriptorData@internal@v8@@QEAA@XZ	400	0x1404ba420
??0CallRuntimeParameters@compiler@internal@v8@@QEAA@W4FunctionId@Runtime@23@_K@Z	401	0x140078f70
??0CallbackScope@AsyncResource@node@@QEAA@PEAV12@@Z	402	0x1402908e0
??0CallbackScope@node@@QEAA@PEAVEnvironment@1@V?$Local@VObject@v8@@@v8@@Uasync_context@1@@Z	403	0x14028f380
??0CallbackScope@node@@QEAA@PEAVIsolate@v8@@V?$Local@VObject@v8@@@3@Uasync_context@1@@Z	404	0x14028f400
??0Cancelable@internal@v8@@QEAA@PEAVCancelableTaskManager@12@@Z	405	0x14047bfa0
??0CancelableTask@internal@v8@@QEAA@PEAVCancelableTaskManager@12@@Z	406	0x1406b7e40
??0CancelableTask@internal@v8@@QEAA@PEAVIsolate@12@@Z	407	0x1406b7e90
??0CancelableTaskManager@internal@v8@@QEAA@XZ	408	0x1406b7ee0
??0CanonicalHandleScope@internal@v8@@QEAA@PEAVIsolate@12@PEAVOptimizedCompilationInfo@12@@Z	409	0x1409f4470
??0Channel@V8Inspector@v8_inspector@@QEAA@AEBV012@@Z	410	0x140079ab0
??0Channel@V8Inspector@v8_inspector@@QEAA@XZ	411	0x140079ab0
??0CheckpointElimination@compiler@internal@v8@@QEAA@AEBV0123@@Z	412	0x140f09840
??0CheckpointElimination@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@@Z	413	0x140f9e570
??0ClassScope@internal@v8@@QEAA@$$QEAV012@@Z	414	0x1406ea500
??0ClassScope@internal@v8@@QEAA@PEAVIsolate@12@PEAVZone@12@PEAVAstValueFactory@12@V?$Handle@VScopeInfo@internal@v8@@@12@@Z	415	0x140af1750
??0ClassScope@internal@v8@@QEAA@PEAVZone@12@PEAVScope@12@_N@Z	416	0x140af19d0
??0CodeAssembler@compiler@internal@v8@@QEAA@PEAVCodeAssemblerState@123@@Z	417	0x140078b40
??0CodeAssemblerLabel@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@AEBV?$ZoneVector@PEAVCodeAssemblerVariable@compiler@internal@v8@@@23@W4Type@0123@@Z	418	0x140ab1f10
??0CodeAssemblerLabel@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@PEAVCodeAssemblerVariable@123@W4Type@0123@@Z	419	0x140ab1f40
??0CodeAssemblerLabel@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@V?$initializer_list@PEAVCodeAssemblerVariable@compiler@internal@v8@@@std@@W4Type@0123@@Z	420	0x140ab1f70
??0CodeAssemblerLabel@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@W4Type@0123@@Z	421	0x140ab1fa0
??0CodeAssemblerLabel@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@_KPEBQEAVCodeAssemblerVariable@123@W4Type@0123@@Z	422	0x140f1c6d0
??0CodeAssemblerState@compiler@internal@v8@@AEAA@PEAVIsolate@23@PEAVZone@23@PEAVCallDescriptor@123@W4CodeKind@23@PEBDW4PoisoningMitigationLevel@23@W4Builtin@23@@Z	423	0x140f1c8d0
??0CodeAssemblerState@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVZone@23@AEBVCallInterfaceDescriptor@23@W4CodeKind@23@PEBDW4PoisoningMitigationLevel@23@W4Builtin@23@@Z	424	0x140f1cb40
??0CodeAssemblerState@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVZone@23@HW4CodeKind@23@PEBDW4PoisoningMitigationLevel@23@W4Builtin@23@@Z	425	0x140f1cbd0
??0CodeAssemblerVariable@compiler@internal@v8@@IEAA@PEAVCodeAssembler@123@W4MachineRepresentation@23@@Z	426	0x140f1cc50
??0CodeAssemblerVariable@compiler@internal@v8@@IEAA@PEAVCodeAssembler@123@W4MachineRepresentation@23@PEAVNode@123@@Z	427	0x140f1cdd0
??0CodeBuilder@Factory@internal@v8@@QEAA@PEAVIsolate@23@AEBVCodeDesc@23@W4CodeKind@23@@Z	428	0x1409ce0c0
??0CodeCommentsIterator@internal@v8@@QEAA@_KI@Z	429	0x140ab3570
??0CodeEntryStorage@internal@v8@@QEAA@XZ	430	0x1407448d0
??0CodeEventHandler@v8@@QEAA@PEAVIsolate@1@@Z	431	0x140b064b0
??0CodeEventLogger@internal@v8@@QEAA@PEAVIsolate@12@@Z	432	0x1408d0f00
??0CodeGenerator@compiler@internal@v8@@QEAA@PEAVZone@23@PEAVFrame@123@PEAVLinkage@123@PEAVInstructionSequence@123@PEAVOptimizedCompilationInfo@23@PEAVIsolate@23@V?$Optional@VOsrHelper@compiler@internal@v8@@@base@3@HPEAVJumpOptimizationInfo@23@W4PoisoningMitigationLevel@23@AEBUAssemblerOptions@23@W4Builtin@23@_K_KPEBD@Z	433	0x140ee44c0
??0CodeMap@internal@v8@@QEAA@AEAVCodeEntryStorage@12@@Z	434	0x14074cc40
??0CodeObjectRegistry@internal@v8@@QEAA@$$QEAV012@@Z	435	0x14047bfe0
??0CodeObjectRegistry@internal@v8@@QEAA@AEBV012@@Z	436	0x14047c010
??0CodeObjectRegistry@internal@v8@@QEAA@XZ	437	0x14047c040
??0CodeSpaceWriteScope@wasm@internal@v8@@QEAA@PEAVNativeModule@123@@Z	438	0x1405d7680
??0CombinedHeapObjectIterator@internal@v8@@QEAA@PEAVHeap@12@W4HeapObjectsFiltering@HeapObjectIterator@12@@Z	439	0x1409f1090
??0CommandLineAPIScope@V8InspectorSession@v8_inspector@@QEAA@AEBV012@@Z	440	0x14042dde0
??0CommandLineAPIScope@V8InspectorSession@v8_inspector@@QEAA@XZ	441	0x14042dde0
??0CommonEnvironmentSetup@node@@AEAA@PEAVMultiIsolatePlatform@1@PEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@V?$function@$$A6APEAVEnvironment@node@@PEBVCommonEnvironmentSetup@2@@Z@4@@Z	442	0x14028e9f0
??0CommonOperatorBuilder@compiler@internal@v8@@QEAA@PEAVZone@23@@Z	443	0x140eaeba0
??0CommonOperatorReducer@compiler@internal@v8@@QEAA@AEBV0123@@Z	444	0x140f09860
??0CommonOperatorReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVGraph@123@PEAVJSHeapBroker@123@PEAVCommonOperatorBuilder@123@PEAVMachineOperatorBuilder@123@PEAVZone@23@@Z	445	0x140f9e970
??0CompactionSpace@internal@v8@@QEAA@PEAVHeap@12@W4AllocationSpace@12@W4Executability@12@W4CompactionSpaceKind@12@@Z	446	0x14047c060
??0Compactor@internal@cppgc@@QEAA@AEAVRawHeap@12@@Z	447	0x140468c80
??0CompilationCache@internal@v8@@AEAA@PEAVIsolate@12@@Z	448	0x140ab06c0
??0CompilationDependencies@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	449	0x140e800f0
??0CompilationDependencies@compiler@internal@v8@@QEAA@AEBV0123@@Z	450	0x140e80120
??0CompilationDependencies@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@PEAVZone@23@@Z	451	0x140f334c0
??0CompilationJob@internal@v8@@QEAA@AEBV012@@Z	452	0x14047c0e0
??0CompilationJob@internal@v8@@QEAA@W4State@012@@Z	453	0x14047c100
??0CompilationResultResolver@wasm@internal@v8@@QEAA@AEBV0123@@Z	454	0x14007a080
??0CompilationResultResolver@wasm@internal@v8@@QEAA@XZ	455	0x14007a080
??0CompiledWasmModule@v8@@AEAA@V?$shared_ptr@VNativeModule@wasm@internal@v8@@@std@@PEBD_K@Z	456	0x140b06510
??0CompiledWasmModule@v8@@QEAA@$$QEAV01@@Z	457	0x1400794f0
??0CompiledWasmModule@v8@@QEAA@AEBV01@@Z	458	0x1400794f0
??0ConcurrentMarker@internal@cppgc@@QEAA@AEAVHeapBase@12@AEAVMarkingWorklists@12@AEAVIncrementalMarkingSchedule@12@PEAVPlatform@2@@Z	459	0x14044f4c0
??0ConcurrentMarkerBase@internal@cppgc@@QEAA@AEAVHeapBase@12@AEAVMarkingWorklists@12@AEAVIncrementalMarkingSchedule@12@PEAVPlatform@2@@Z	460	0x140467cc0
??0ConcurrentMarking@internal@v8@@QEAA@PEAVHeap@12@PEAVMarkingWorklists@12@PEAVWeakObjects@12@@Z	461	0x1409ec5e0
??0ConcurrentMarkingVisitor@internal@cppgc@@QEAA@AEAVHeapBase@12@AEAVConcurrentMarkingState@12@@Z	462	0x14045a150
??0ConcurrentUnifiedHeapMarkingVisitor@internal@v8@@QEAA@AEAVHeapBase@1cppgc@@AEAVConcurrentMarkingState@14@AEAVUnifiedHeapMarkingState@12@@Z	463	0x1409e6620
??0ConcurrentUnifiedHeapMarkingVisitor@internal@v8@@QEAA@AEBV012@@Z	464	0x1409e6640
??0ConditionVariable@base@v8@@QEAA@XZ	465	0x140e63680
??0ConditionalControlFlowBuilder@interpreter@internal@v8@@QEAA@PEAVBytecodeArrayBuilder@123@PEAVBlockCoverageBuilder@123@PEAVAstNode@23@@Z	466	0x1408f2860
??0Constant@compiler@internal@v8@@QEAA@H@Z	467	0x140ea3990
??0Constant@compiler@internal@v8@@QEAA@M@Z	468	0x1404ba450
??0Constant@compiler@internal@v8@@QEAA@N@Z	469	0x1404ba470
??0Constant@compiler@internal@v8@@QEAA@PEBVStringConstantBase@23@@Z	470	0x1404ba490
??0Constant@compiler@internal@v8@@QEAA@V?$Handle@VHeapObject@internal@v8@@@23@_N@Z	471	0x1404ba4b0
??0Constant@compiler@internal@v8@@QEAA@VExternalReference@23@@Z	472	0x1404ba4d0
??0Constant@compiler@internal@v8@@QEAA@VRelocatablePtrConstantInfo@123@@Z	473	0x140ea39b0
??0Constant@compiler@internal@v8@@QEAA@VRpoNumber@123@@Z	474	0x1404ba4f0
??0Constant@compiler@internal@v8@@QEAA@_J@Z	475	0x1404ba510
??0ConstantArrayBuilder@interpreter@internal@v8@@QEAA@$$QEAV0123@@Z	476	0x1408f05e0
??0ConstantArrayBuilder@interpreter@internal@v8@@QEAA@PEAVZone@23@@Z	477	0x1408f4c50
??0ConstantFoldingReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@@Z	478	0x140fa0460
??0Contents@ArrayBuffer@v8@@AEAA@PEAX_K01W4AllocationMode@Allocator@12@P6AX010@Z0@Z	479	0x140b065d0
??0Contents@ArrayBuffer@v8@@QEAA@XZ	480	0x140078d00
??0Contents@SharedArrayBuffer@v8@@AEAA@PEAX_K01W4AllocationMode@Allocator@ArrayBuffer@2@P6AX010@Z0@Z	481	0x140b065d0
??0Contents@SharedArrayBuffer@v8@@QEAA@XZ	482	0x140078d00
??0ContextDeserializer@internal@v8@@AEAA@PEAVIsolate@12@PEBVSnapshotData@12@_N@Z	483	0x1406c1bc0
??0ContextSerializer@internal@v8@@QEAA@PEAVIsolate@12@V?$Flags@W4SerializerFlag@Snapshot@internal@v8@@H@base@2@PEAVStartupSerializer@12@USerializeInternalFieldsCallback@2@@Z	484	0x1406d9020
??0ControlEquivalence@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	485	0x14104eb00
??0ControlEquivalence@compiler@internal@v8@@QEAA@AEBV0123@@Z	486	0x14104eb60
??0ControlEquivalence@compiler@internal@v8@@QEAA@PEAVZone@23@PEAVGraph@123@@Z	487	0x14104ec40
??0ControlFlowBuilder@interpreter@internal@v8@@QEAA@PEAVBytecodeArrayBuilder@123@@Z	488	0x1408f29c0
??0ControlFlowOptimizer@compiler@internal@v8@@QEAA@PEAVGraph@123@PEAVCommonOperatorBuilder@123@PEAVMachineOperatorBuilder@123@PEAVTickCounter@23@PEAVZone@23@@Z	489	0x140fa08e0
??0Counters@V8Inspector@v8_inspector@@QEAA@AEBV012@@Z	490	0x14042ddf0
??0Counters@V8Inspector@v8_inspector@@QEAA@PEAVIsolate@v8@@@Z	491	0x140672180
??0Coverage@debug@v8@@AEAA@V?$shared_ptr@VCoverage@internal@v8@@@std@@@Z	492	0x14042dd80
??0Coverage@debug@v8@@QEAA@$$QEAV012@@Z	493	0x14042dd80
??0CppHeap@internal@v8@@QEAA@PEAVPlatform@2@AEBV?$vector@V?$unique_ptr@VCustomSpaceBase@cppgc@@U?$default_delete@VCustomSpaceBase@cppgc@@@std@@@std@@V?$allocator@V?$unique_ptr@VCustomSpaceBase@cppgc@@U?$default_delete@VCustomSpaceBase@cppgc@@@std@@@std@@@2@@std@@AEBUWrapperDescriptor@2@@Z	494	0x1409e8890
??0CppHeap@v8@@AEAA@XZ	495	0x14042dde0
??0CppHeap@v8@@QEAA@AEBV01@@Z	496	0x14042dde0
??0CpuFeatureScope@internal@v8@@QEAA@PEAVAssemblerBase@12@W4CpuFeature@12@W4CheckPolicy@012@@Z	497	0x140078ac0
??0CpuProfile@internal@v8@@QEAA@PEAVCpuProfiler@12@PEBDVCpuProfilingOptions@2@V?$unique_ptr@VDiscardedSamplesDelegate@v8@@U?$default_delete@VDiscardedSamplesDelegate@v8@@@std@@@std@@@Z	498	0x14074cc90
??0CpuProfileDeoptInfo@v8@@QEAA@$$QEAU01@@Z	499	0x140079ec0
??0CpuProfileDeoptInfo@v8@@QEAA@AEBU01@@Z	500	0x140079e30
??0CpuProfileDeoptInfo@v8@@QEAA@XZ	501	0x140079db0
??0CpuProfiler@internal@v8@@QEAA@PEAVIsolate@12@W4CpuProfilingNamingMode@2@W4CpuProfilingLoggingMode@2@@Z	502	0x140760350
??0CpuProfiler@internal@v8@@QEAA@PEAVIsolate@12@W4CpuProfilingNamingMode@2@W4CpuProfilingLoggingMode@2@PEAVCpuProfilesCollection@12@PEAVSymbolizer@12@PEAVProfilerEventsProcessor@12@PEAVProfilerCodeObserver@12@@Z	503	0x140760430
??0CpuProfilesCollection@internal@v8@@QEAA@PEAVIsolate@12@@Z	504	0x14074cee0
??0CpuProfilingOptions@v8@@QEAA@W4CpuProfilingMode@1@IHV?$MaybeLocal@VContext@v8@@@1@@Z	505	0x140b06610
??0CreateParams@Isolate@v8@@QEAA@AEBU012@@Z	506	0x140079b30
??0CreateParams@Isolate@v8@@QEAA@XZ	507	0x140b06620
??0CrossThreadPersistentRegion@internal@cppgc@@QEAA@XZ	508	0x14044f4f0
??0CsaLoadElimination@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVZone@23@@Z	509	0x140f098b0
??0DateCache@internal@v8@@QEAA@AEBV012@@Z	510	0x1407057b0
??0DateCache@internal@v8@@QEAA@XZ	511	0x140a79220
??0DbgStreamBuf@internal@v8@@QEAA@AEBV012@@Z	512	0x14047c140
??0DbgStreamBuf@internal@v8@@QEAA@XZ	513	0x1406b3920
??0DeadCodeElimination@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVGraph@123@PEAVCommonOperatorBuilder@123@PEAVZone@23@@Z	514	0x140fac6a0
??0Debug@internal@v8@@AEAA@PEAVIsolate@12@@Z	515	0x140a5c730
??0DebugInfo@wasm@internal@v8@@QEAA@PEAVNativeModule@123@@Z	516	0x14055e680
??0DeclarationScope@internal@v8@@QEAA@$$QEAV012@@Z	517	0x1406ea580
??0DeclarationScope@internal@v8@@QEAA@PEAVZone@12@PEAVAstValueFactory@12@W4REPLMode@12@@Z	518	0x140af1a20
??0DeclarationScope@internal@v8@@QEAA@PEAVZone@12@PEAVScope@12@W4ScopeType@12@W4FunctionKind@12@@Z	519	0x140af1b30
??0DeclarationScope@internal@v8@@QEAA@PEAVZone@12@W4ScopeType@12@PEAVAstValueFactory@12@V?$Handle@VScopeInfo@internal@v8@@@12@@Z	520	0x140af1bd0
??0DefaultEmbedderRootsHandler@internal@v8@@QEAA@$$QEAV012@@Z	521	0x140952110
??0DefaultEmbedderRootsHandler@internal@v8@@QEAA@AEBV012@@Z	522	0x140952110
??0DefaultEmbedderRootsHandler@internal@v8@@QEAA@XZ	523	0x140952130
??0DefaultPlatform@cppgc@@QEAA@$$QEAV01@@Z	524	0x140467400
??0DefaultPlatform@cppgc@@QEAA@HW4IdleTaskSupport@platform@v8@@V?$unique_ptr@VTracingController@v8@@U?$default_delete@VTracingController@v8@@@std@@@std@@@Z	525	0x140467420
??0Delegate@ValueDeserializer@v8@@QEAA@AEBV012@@Z	526	0x1400793c0
??0Delegate@ValueDeserializer@v8@@QEAA@XZ	527	0x1400793c0
??0Delegate@ValueSerializer@v8@@QEAA@AEBV012@@Z	528	0x1400793b0
??0Delegate@ValueSerializer@v8@@QEAA@XZ	529	0x1400793b0
??0Descriptor@internal@v8@@IEAA@V?$Handle@VName@internal@v8@@@12@AEBVMaybeObjectHandle@12@VPropertyDetails@12@@Z	530	0x1407ddc50
??0Descriptor@internal@v8@@IEAA@V?$Handle@VName@internal@v8@@@12@AEBVMaybeObjectHandle@12@W4PropertyKind@12@W4PropertyAttributes@12@W4PropertyLocation@12@W4PropertyConstness@12@VRepresentation@12@H@Z	531	0x1407ddc70
??0Descriptor@internal@v8@@QEAA@XZ	532	0x1407ddcb0
??0DetachableVectorBase@internal@v8@@QEAA@XZ	533	0x14007b730
??0DiamondMatcher@compiler@internal@v8@@QEAA@PEAVNode@123@@Z	534	0x141099180
??0DisallowCompilation@internal@v8@@QEAA@PEAVIsolate@12@@Z	535	0x140a7d7e0
??0DisallowDeoptimization@internal@v8@@QEAA@PEAVIsolate@12@@Z	536	0x140a7d800
??0DisallowExceptions@internal@v8@@QEAA@PEAVIsolate@12@@Z	537	0x140a7d820
??0DisallowGarbageCollectionScope@subtle@cppgc@@QEAA@AEAVHeapHandle@2@@Z	538	0x140464fb0
??0DisallowJavascriptExecution@internal@v8@@QEAA@PEAVIsolate@12@@Z	539	0x140a7d840
??0DisallowJavascriptExecutionScope@Isolate@v8@@QEAA@PEAV12@W4OnFailure@012@@Z	540	0x140b06690
??0DiscardedSamplesDelegate@v8@@QEAA@AEBV01@@Z	541	0x140079fd0
??0DiscardedSamplesDelegate@v8@@QEAA@XZ	542	0x140079fd0
??0DisjointAllocationPool@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	543	0x14047c1e0
??0DisjointAllocationPool@wasm@internal@v8@@QEAA@VAddressRegion@base@3@@Z	544	0x14047c240
??0DisjointAllocationPool@wasm@internal@v8@@QEAA@XZ	545	0x140458470
??0Domain@API@Schema@protocol@v8_inspector@@QEAA@$$QEAV01234@@Z	546	0x14042dea0
??0Domain@API@Schema@protocol@v8_inspector@@QEAA@AEBV01234@@Z	547	0x14042dea0
??0Domain@API@Schema@protocol@v8_inspector@@QEAA@XZ	548	0x14042dea0
??0DumpOnJavascriptExecution@internal@v8@@QEAA@PEAVIsolate@12@@Z	549	0x140a7d860
??0EhFrameIterator@internal@v8@@QEAA@PEBE0@Z	550	0x1400bb830
??0EhFrameWriter@internal@v8@@QEAA@PEAVZone@12@@Z	551	0x140a40580
??0EmbedderGraph@v8@@QEAA@AEBV01@@Z	552	0x14007a090
??0EmbedderGraph@v8@@QEAA@XZ	553	0x14007a090
??0EmbedderHeapTracer@v8@@QEAA@AEBV01@@Z	554	0x140079af0
??0EmbedderHeapTracer@v8@@QEAA@XZ	555	0x140079ad0
??0EmbedderRootsHandler@v8@@QEAA@AEBV01@@Z	556	0x140079ab0
??0EmbedderRootsHandler@v8@@QEAA@XZ	557	0x140079ab0
??0EmbedderStackStateScope@internal@v8@@QEAA@PEAVLocalEmbedderHeapTracer@12@W4EmbedderStackState@cppgc@@@Z	558	0x140952150
??0EnabledCheckingPolicy@internal@cppgc@@QEAA@XZ	559	0x1400fba60
??0Entry@TypeProfile@debug@v8@@AEAA@PEBUTypeProfileEntry@internal@3@V?$shared_ptr@VTypeProfile@internal@v8@@@std@@@Z	560	0x14047bd70
??0Entry@TypeProfile@debug@v8@@QEAA@$$QEAV0123@@Z	561	0x14047bda0
??0EphemeronHashTable@internal@v8@@IEAA@_K@Z	562	0x140078b40
??0EphemeronHashTable@internal@v8@@QEAA@XZ	563	0x1400fba60
??0ErrorThrower@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	564	0x14052b1d0
??0ErrorThrower@wasm@internal@v8@@QEAA@PEAVIsolate@23@PEBD@Z	565	0x140523620
??0EscapableHandleScope@v8@@QEAA@PEAVIsolate@1@@Z	566	0x140b06700
??0EscapeAnalysis@compiler@internal@v8@@QEAA@PEAVJSGraph@123@PEAVTickCounter@23@PEAVZone@23@@Z	567	0x140fce6d0
??0EscapeAnalysisReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@VEscapeAnalysisResult@123@PEAVZone@23@@Z	568	0x140fd36d0
??0Event@StatsCollector@internal@cppgc@@QEAA@XZ	569	0x1404556f0
??0Exported@protocol@v8_inspector@@QEAA@AEBV012@@Z	570	0x14042dea0
??0Exported@protocol@v8_inspector@@QEAA@XZ	571	0x14042dea0
??0Extension@v8@@QEAA@PEBD0HPEAPEBDH@Z	572	0x140b06770
??0ExtensionConfiguration@v8@@QEAA@HQEAPEBD@Z	573	0x140078f70
??0ExtensionConfiguration@v8@@QEAA@XZ	574	0x140078f60
??0ExternalMarkingWorklist@MarkingWorklists@internal@cppgc@@QEAA@XZ	575	0x14044f510
??0ExternalOneByteStringResource@String@v8@@IEAA@XZ	576	0x1400793e0
??0ExternalPointerTable@internal@v8@@QEAA@XZ	577	0x14047c350
??0ExternalResourceVisitor@v8@@QEAA@AEBV01@@Z	578	0x140079aa0
??0ExternalResourceVisitor@v8@@QEAA@XZ	579	0x140079aa0
??0ExternalSourceStream@ScriptCompiler@v8@@QEAA@AEBV012@@Z	580	0x140078b50
??0ExternalSourceStream@ScriptCompiler@v8@@QEAA@XZ	581	0x140078b50
??0ExternalStringResource@String@v8@@IEAA@XZ	582	0x1400793e0
??0ExternalStringResourceBase@String@v8@@IEAA@XZ	583	0x1400793d0
??0FeedbackIterator@internal@v8@@QEAA@PEBVFeedbackNexus@12@@Z	584	0x140878870
??0FeedbackNexus@internal@v8@@QEAA@V?$Handle@VFeedbackVector@internal@v8@@@12@VFeedbackSlot@12@@Z	585	0x1408789e0
??0FeedbackNexus@internal@v8@@QEAA@V?$Handle@VFeedbackVector@internal@v8@@@12@VFeedbackSlot@12@AEBVNexusConfig@12@@Z	586	0x140878a70
??0FeedbackNexus@internal@v8@@QEAA@VFeedbackVector@12@VFeedbackSlot@12@@Z	587	0x140878ae0
??0FeedbackSource@compiler@internal@v8@@QEAA@V?$Handle@VFeedbackVector@internal@v8@@@23@VFeedbackSlot@23@@Z	588	0x1404ba550
??0FeedbackVectorSpec@internal@v8@@QEAA@$$QEAV012@@Z	589	0x14047c390
??0FeedbackVectorSpec@internal@v8@@QEAA@AEBV012@@Z	590	0x14047c3d0
??0FeedbackVectorSpec@internal@v8@@QEAA@PEAVZone@12@@Z	591	0x14047c4a0
??0FlatStringReader@internal@v8@@QEAA@$$QEAV012@@Z	592	0x14047c550
??0FlatStringReader@internal@v8@@QEAA@AEBV012@@Z	593	0x14047c550
??0FlatStringReader@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VString@internal@v8@@@12@@Z	594	0x1407c3470
??0Frame@compiler@internal@v8@@QEAA@H@Z	595	0x140ee3070
??0FrameSummary@internal@v8@@QEAA@VJavaScriptFrameSummary@012@@Z	596	0x14049b040
??0FrameSummary@internal@v8@@QEAA@VWasmFrameSummary@012@@Z	597	0x14049b070
??0FreeList@internal@cppgc@@QEAA@$$QEAV012@@Z	598	0x140466810
??0FreeList@internal@cppgc@@QEAA@XZ	599	0x140466910
??0FreeListMany@internal@v8@@QEAA@XZ	600	0x1409cc740
??0FreeListManyCached@internal@v8@@QEAA@XZ	601	0x1409cc7d0
??0FreeListManyCachedFastPath@internal@v8@@QEAA@XZ	602	0x14047c5a0
??0FreeListManyCachedOrigin@internal@v8@@QEAA@XZ	603	0x14047c5d0
??0FunctionData@Coverage@debug@v8@@AEAA@PEAUCoverageFunction@internal@3@V?$shared_ptr@VCoverage@internal@v8@@@std@@@Z	604	0x14047bd70
??0FunctionData@Coverage@debug@v8@@QEAA@$$QEAV0123@@Z	605	0x14047bda0
??0GCInfoTable@internal@cppgc@@QEAA@PEAVPageAllocator@v8@@@Z	606	0x140466330
??0GCInvoker@internal@cppgc@@QEAA@PEAVGarbageCollector@12@PEAVPlatform@2@W4StackSupport@Heap@2@@Z	607	0x140465b90
??0GCTracer@internal@v8@@QEAA@PEAVHeap@12@@Z	608	0x1409c7610
??0GlobalDictionary@internal@v8@@IEAA@_K@Z	609	0x140078b40
??0GlobalDictionary@internal@v8@@QEAA@XZ	610	0x1400fba60
??0GlobalHandles@internal@v8@@QEAA@PEAVIsolate@12@@Z	611	0x1409f50a0
??0Graph@compiler@internal@v8@@QEAA@PEAVZone@23@@Z	612	0x140f54350
??0GraphAssembler@compiler@internal@v8@@QEAA@PEAVMachineGraph@123@PEAVZone@23@V?$Optional@V?$function@$$A6AXPEAVNode@compiler@internal@v8@@@Z@std@@@base@3@PEAVSchedule@123@_N@Z	613	0x140f58430
??0GraphReducer@compiler@internal@v8@@QEAA@PEAVZone@23@PEAVGraph@123@PEAVTickCounter@23@PEAVJSHeapBroker@123@PEAVNode@123@PEAVObserveNodeManager@123@@Z	614	0x140f36d30
??0GraphTrimmer@compiler@internal@v8@@QEAA@PEAVZone@23@PEAVGraph@123@@Z	615	0x140fd5dd0
??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z	616	0x140b06830
??0HandlerTable@internal@v8@@QEAA@PEBVWasmCode@wasm@12@@Z	617	0x140a9f3a0
??0HandlerTable@internal@v8@@QEAA@VByteArray@12@@Z	618	0x140a9f400
??0HandlerTable@internal@v8@@QEAA@VBytecodeArray@12@@Z	619	0x140a9f430
??0HandlerTable@internal@v8@@QEAA@VCode@12@@Z	620	0x140a9f460
??0HandlerTable@internal@v8@@QEAA@_KHW4EncodingMode@012@@Z	621	0x140a9f4b0
??0HandlerTableBuilder@interpreter@internal@v8@@QEAA@PEAVZone@23@@Z	622	0x1404b9c40
??0HashTableBase@internal@v8@@IEAA@_K@Z	623	0x140078b40
??0HashTableBase@internal@v8@@QEAA@XZ	624	0x1400fba60
??0Heap@cppgc@@AEAA@XZ	625	0x14042dde0
??0Heap@cppgc@@QEAA@AEBV01@@Z	626	0x14042dde0
??0Heap@internal@cppgc@@QEAA@V?$shared_ptr@VPlatform@cppgc@@@std@@UHeapOptions@02@@Z	627	0x140461c50
??0HeapBase@internal@cppgc@@QEAA@V?$shared_ptr@VPlatform@cppgc@@@std@@AEBV?$vector@V?$unique_ptr@VCustomSpaceBase@cppgc@@U?$default_delete@VCustomSpaceBase@cppgc@@@std@@@std@@V?$allocator@V?$unique_ptr@VCustomSpaceBase@cppgc@@U?$default_delete@VCustomSpaceBase@cppgc@@@std@@@std@@@2@@4@W4StackSupport@Heap@2@@Z	628	0x1404650d0
??0HeapCodeStatistics@v8@@QEAA@XZ	629	0x14007b730
??0HeapConstantType@compiler@internal@v8@@AEAA@IAEBVHeapObjectRef@123@@Z	630	0x140e9f8d0
??0HeapGrowing@internal@cppgc@@QEAA@PEAVGarbageCollector@12@PEAVStatsCollector@12@UResourceConstraints@Heap@2@W4MarkingType@62@W4SweepingType@62@@Z	631	0x140464b90
??0HeapObjectIterator@internal@v8@@QEAA@PEAVHeap@12@W4HeapObjectsFiltering@012@@Z	632	0x1409adb10
??0HeapObjectStatistics@v8@@QEAA@XZ	633	0x140b06850
??0HeapSpaceStatistics@v8@@QEAA@XZ	634	0x14044f4f0
??0HeapStatistics@v8@@QEAA@XZ	635	0x140b06870
??0HiddenLocalFactory@internal@v8@@QEAA@PEAVIsolate@12@@Z	636	0x14047c600
??0I32PairToBigIntDescriptor@internal@v8@@IEAA@W4Key@CallDescriptors@12@@Z	637	0x1404b9be0
??0I32PairToBigIntDescriptor@internal@v8@@QEAA@XZ	638	0x1404ba530
??0I64ToBigIntDescriptor@internal@v8@@IEAA@W4Key@CallDescriptors@12@@Z	639	0x1404b9be0
??0I64ToBigIntDescriptor@internal@v8@@QEAA@XZ	640	0x1404ba540
??0IdentityMapBase@internal@v8@@IEAA@PEAVHeap@12@@Z	641	0x1404e2f80
??0IncrementalMarking@internal@v8@@QEAA@PEAVHeap@12@PEAVWeakObjects@12@@Z	642	0x1409a6550
??0IncrementalMarkingSchedule@internal@cppgc@@QEAA@XZ	643	0x14044f590
??0IndexGenerator@internal@v8@@QEAA@_K@Z	644	0x1409a5dc0
??0IndirectFunctionTableEntry@internal@v8@@QEAA@V?$Handle@VWasmIndirectFunctionTable@internal@v8@@@12@H@Z	645	0x14047c620
??0IndirectFunctionTableEntry@internal@v8@@QEAA@V?$Handle@VWasmInstanceObject@internal@v8@@@12@HH@Z	646	0x14047c640
??0Inputs@Node@compiler@internal@v8@@QEAA@PEBQEAV1234@H@Z	647	0x1404ba550
??0Inspectable@V8InspectorSession@v8_inspector@@QEAA@AEBV012@@Z	648	0x14042deb0
??0Inspectable@V8InspectorSession@v8_inspector@@QEAA@XZ	649	0x14042deb0
??0InstantiationResultResolver@wasm@internal@v8@@QEAA@AEBV0123@@Z	650	0x14007a080
??0InstantiationResultResolver@wasm@internal@v8@@QEAA@XZ	651	0x14007a080
??0Instruction@compiler@internal@v8@@AEAA@I@Z	652	0x140ea3bb0
??0Instruction@compiler@internal@v8@@AEAA@I_KPEAVInstructionOperand@123@0101@Z	653	0x140ea3bd0
??0InstructionBlock@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	654	0x1404ba560
??0InstructionBlock@compiler@internal@v8@@QEAA@AEBV0123@@Z	655	0x1404ba6b0
??0InstructionBlock@compiler@internal@v8@@QEAA@PEAVZone@23@VRpoNumber@123@111_N2@Z	656	0x140ea3cb0
??0InstructionOperand@compiler@internal@v8@@IEAA@W4Kind@0123@@Z	657	0x1404ba830
??0InstructionOperand@compiler@internal@v8@@QEAA@XZ	658	0x1400fba60
??0InstructionScheduler@compiler@internal@v8@@QEAA@PEAVZone@23@PEAVInstructionSequence@123@@Z	659	0x140f53310
??0InstructionSelector@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	660	0x1404c0cb0
??0InstructionSelector@compiler@internal@v8@@QEAA@AEBV0123@@Z	661	0x1404c1240
??0InstructionSelector@compiler@internal@v8@@QEAA@PEAVZone@23@_KPEAVLinkage@123@PEAVInstructionSequence@123@PEAVSchedule@123@PEAVSourcePositionTable@123@PEAVFrame@123@W4EnableSwitchJumpTable@0123@PEAVTickCounter@23@PEAVJSHeapBroker@123@PEA_KPEA_KW4SourcePositionMode@0123@VFeatures@0123@W4EnableScheduling@0123@W4EnableRootsRelativeAddressing@0123@W4PoisoningMitigationLevel@23@W4EnableTraceTurboJson@0123@@Z	662	0x140ed2cc0
??0InstructionSequence@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVZone@23@PEAV?$ZoneVector@PEAVInstructionBlock@compiler@internal@v8@@@23@@Z	663	0x140ea3d30
??0Int64Lowering@compiler@internal@v8@@QEAA@PEAVGraph@123@PEAVMachineOperatorBuilder@123@PEAVCommonOperatorBuilder@123@PEAVSimplifiedOperatorBuilder@123@PEAVZone@23@PEAV?$Signature@W4MachineRepresentation@internal@v8@@@23@V?$unique_ptr@UInt64LoweringSpecialCase@compiler@internal@v8@@U?$default_delete@UInt64LoweringSpecialCase@compiler@internal@v8@@@std@@@std@@@Z	664	0x140f68430
??0Int64LoweringSpecialCase@compiler@internal@v8@@QEAA@$$QEAU0123@@Z	665	0x14047cd10
??0Int64LoweringSpecialCase@compiler@internal@v8@@QEAA@AEBU0123@@Z	666	0x14047cdf0
??0Int64LoweringSpecialCase@compiler@internal@v8@@QEAA@XZ	667	0x14047ce80
??0InterpreterDispatchDescriptor@internal@v8@@IEAA@W4Key@CallDescriptors@12@@Z	668	0x1404b9be0
??0InterpreterDispatchDescriptor@internal@v8@@QEAA@XZ	669	0x1404ba840
??0InterruptsScope@internal@v8@@QEAA@PEAVIsolate@12@_JW4Mode@012@@Z	670	0x140a1b250
??0InvalidatedSlotsCleanup@internal@v8@@QEAA@$$QEAV012@@Z	671	0x14047c700
??0InvalidatedSlotsCleanup@internal@v8@@QEAA@AEBV012@@Z	672	0x14047c790
??0InvalidatedSlotsCleanup@internal@v8@@QEAA@PEAVMemoryChunk@12@PEAV?$set@VHeapObject@internal@v8@@UComparer@Object@23@V?$allocator@VHeapObject@internal@v8@@@std@@@std@@@Z	673	0x1409a5b20
??0InvalidatedSlotsFilter@internal@v8@@QEAA@$$QEAV012@@Z	674	0x14047c820
??0InvalidatedSlotsFilter@internal@v8@@QEAA@AEBV012@@Z	675	0x14047c8b0
??0InvalidatedSlotsFilter@internal@v8@@QEAA@PEAVMemoryChunk@12@PEAV?$set@VHeapObject@internal@v8@@UComparer@Object@23@V?$allocator@VHeapObject@internal@v8@@@std@@@std@@@Z	676	0x1409a5bc0
??0Isolate@internal@v8@@AEAA@V?$unique_ptr@VIsolateAllocator@internal@v8@@U?$default_delete@VIsolateAllocator@internal@v8@@@std@@@std@@_N@Z	677	0x140a09930
??0IsolateAllocator@internal@v8@@QEAA@XZ	678	0x140924c90
??0IsolatePlatformDelegate@node@@QEAA@$$QEAV01@@Z	679	0x14007a120
??0IsolatePlatformDelegate@node@@QEAA@AEBV01@@Z	680	0x14007a120
??0IsolatePlatformDelegate@node@@QEAA@XZ	681	0x14007a120
??0Iterator@Script@internal@v8@@QEAA@PEAVIsolate@23@@Z	682	0x1407edbe0
??0JSCallReducer@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	683	0x140f09af0
??0JSCallReducer@compiler@internal@v8@@QEAA@AEBV0123@@Z	684	0x140f09c60
??0JSCallReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@PEAVZone@23@V?$Flags@W4Flag@JSCallReducer@compiler@internal@v8@@H@base@3@@Z	685	0x140f09e00
??0JSContextSpecialization@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@V?$Maybe@UOuterContext@compiler@internal@v8@@@3@V?$MaybeHandle@VJSFunction@internal@v8@@@23@@Z	686	0x140f09e70
??0JSCreateLowering@compiler@internal@v8@@QEAA@AEBV0123@@Z	687	0x140f09eb0
??0JSCreateLowering@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVCompilationDependencies@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@PEAVZone@23@@Z	688	0x140f09ef0
??0JSFunctionBuilder@Factory@internal@v8@@QEAA@PEAVIsolate@23@V?$Handle@VSharedFunctionInfo@internal@v8@@@23@V?$Handle@VContext@internal@v8@@@23@@Z	689	0x1409ce120
??0JSFunctionRef@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@PEAVObjectData@123@_N@Z	690	0x1404ba850
??0JSGraph@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVGraph@123@PEAVCommonOperatorBuilder@123@PEAVJSOperatorBuilder@123@PEAVSimplifiedOperatorBuilder@123@PEAVMachineOperatorBuilder@123@@Z	691	0x140ed3170
??0JSGraphAssembler@compiler@internal@v8@@QEAA@PEAVJSGraph@123@PEAVZone@23@V?$Optional@V?$function@$$A6AXPEAVNode@compiler@internal@v8@@@Z@std@@@base@3@PEAVSchedule@123@_N@Z	692	0x140eeae10
??0JSHeapBroker@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVZone@23@@Z	693	0x140e80a60
??0JSHeapBroker@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVZone@23@_N2W4CodeKind@23@@Z	694	0x140f2d740
??0JSHeapCopyReducer@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	695	0x140f09f20
??0JSHeapCopyReducer@compiler@internal@v8@@QEAA@AEBV0123@@Z	696	0x140f09f20
??0JSHeapCopyReducer@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@@Z	697	0x141010950
??0JSIntrinsicLowering@compiler@internal@v8@@QEAA@AEBV0123@@Z	698	0x140f0a0c0
??0JSIntrinsicLowering@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@@Z	699	0x141014bf0
??0JSNativeContextSpecialization@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@V?$Flags@W4Flag@JSNativeContextSpecialization@compiler@internal@v8@@H@base@3@PEAVCompilationDependencies@123@PEAVZone@23@5@Z	700	0x141017580
??0JSOperatorBuilder@compiler@internal@v8@@QEAA@PEAVZone@23@@Z	701	0x140f38dd0
??0JSToWasmWrapperCompilationUnit@wasm@internal@v8@@QEAA@PEAVIsolate@23@PEBV?$Signature@VValueType@wasm@internal@v8@@@23@PEBUWasmModule@123@_NAEBVWasmFeatures@123@W4AllowGeneric@0123@@Z	702	0x1405bf6b0
??0JSTypedLowering@compiler@internal@v8@@QEAA@AEBV0123@@Z	703	0x140f0a0f0
??0JSTypedLowering@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@PEAVZone@23@@Z	704	0x141026020
??0JumpTableAssembler@wasm@internal@v8@@AEAA@_KH@Z	705	0x14052e680
??0JumpTableTargetOffsets@interpreter@internal@v8@@QEAA@PEBVBytecodeArrayIterator@123@HHH@Z	706	0x140913680
??0LargeObjectSpace@internal@v8@@IEAA@PEAVHeap@12@W4AllocationSpace@12@@Z	707	0x1409a4160
??0LargePage@internal@cppgc@@AEAA@AEAVHeapBase@12@AEAVBaseSpace@12@_K@Z	708	0x1404646a0
??0LargePageMemoryRegion@internal@cppgc@@QEAA@PEAVPageAllocator@v8@@_K@Z	709	0x140458120
??0LargePageSpace@internal@cppgc@@QEAA@PEAVRawHeap@12@_K@Z	710	0x1404644c0
??0LazilyGeneratedNames@wasm@internal@v8@@QEAA@XZ	711	0x14047c940
??0LazyCompileDispatcher@internal@v8@@QEAA@PEAVIsolate@12@PEAVPlatform@2@_K@Z	712	0x140a7b5f0
??0Linkage@compiler@internal@v8@@QEAA@PEAVCallDescriptor@123@@Z	713	0x140078b40
??0LiveRange@compiler@internal@v8@@AEAA@HW4MachineRepresentation@23@PEAVTopLevelLiveRange@123@@Z	714	0x140f7e410
??0LoadElimination@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVZone@23@@Z	715	0x140f0a140
??0Local@MarkingWorklists@internal@v8@@QEAA@PEAV123@@Z	716	0x140975dc0
??0LocalAllocationBuffer@internal@v8@@AEAA@PEAVHeap@12@VLinearAllocationArea@12@@Z	717	0x140955ca0
??0LocalAllocationBuffer@internal@v8@@QEAA@$$QEAV012@@Z	718	0x140955cf0
??0LocalDeclEncoder@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	719	0x14053d6a0
??0LocalDeclEncoder@wasm@internal@v8@@QEAA@AEBV0123@@Z	720	0x14053d6e0
??0LocalDeclEncoder@wasm@internal@v8@@QEAA@PEAVZone@23@PEBV?$Signature@VValueType@wasm@internal@v8@@@23@@Z	721	0x14053d7c0
??0LocalEmbedderHeapTracer@internal@v8@@QEAA@AEBV012@@Z	722	0x140952260
??0LocalEmbedderHeapTracer@internal@v8@@QEAA@PEAVIsolate@12@@Z	723	0x1409522c0
??0LocalFactory@internal@v8@@QEAA@PEAVIsolate@12@@Z	724	0x1409a4000
??0LocalHeap@internal@v8@@QEAA@PEAVHeap@12@W4ThreadKind@12@V?$unique_ptr@VPersistentHandles@internal@v8@@U?$default_delete@VPersistentHandles@internal@v8@@@std@@@std@@@Z	725	0x1409a3220
??0LocalIsolate@internal@v8@@QEAA@PEAVIsolate@12@W4ThreadKind@12@PEAVRuntimeCallStats@12@@Z	726	0x140a08420
??0Location@debug@v8@@QEAA@HH@Z	727	0x140a6d890
??0Location@debug@v8@@QEAA@XZ	728	0x140a6d8a0
??0Location@v8@@QEAA@HH@Z	729	0x140078af0
??0Locker@v8@@QEAA@PEAVIsolate@1@@Z	730	0x140078fb0
??0LookupIterator@internal@v8@@AEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@V?$Handle@VName@internal@v8@@@12@V?$Handle@VMap@internal@v8@@@12@VPropertyDetails@12@_N@Z	731	0x14081b980
??0LookupIterator@internal@v8@@AEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@V?$Handle@VName@internal@v8@@@12@_K1W4Configuration@012@@Z	732	0x14047c960
??0LookupIterator@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@AEBVPropertyKey@12@1W4Configuration@012@@Z	733	0x14047cb10
??0LookupIterator@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@AEBVPropertyKey@12@W4Configuration@012@@Z	734	0x14047cb50
??0LookupIterator@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@V?$Handle@VName@internal@v8@@@12@1W4Configuration@012@@Z	735	0x14047cb80
??0LookupIterator@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@V?$Handle@VName@internal@v8@@@12@W4Configuration@012@@Z	736	0x14047cbc0
??0LookupIterator@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@_K1W4Configuration@012@@Z	737	0x14047cbf0
??0LookupIterator@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VObject@internal@v8@@@12@_KW4Configuration@012@@Z	738	0x14047cc30
??0LoopBuilder@interpreter@internal@v8@@QEAA@PEAVBytecodeArrayBuilder@123@PEAVBlockCoverageBuilder@123@PEAVAstNode@23@@Z	739	0x1408f29e0
??0LoopInfo@compiler@internal@v8@@QEAA@$$QEAU0123@@Z	740	0x140f919c0
??0LoopInfo@compiler@internal@v8@@QEAA@AEBU0123@@Z	741	0x140f91a10
??0LoopInfo@compiler@internal@v8@@QEAA@HHHPEAVZone@23@@Z	742	0x140f91b10
??0LoopPeeler@compiler@internal@v8@@QEAA@PEAVGraph@123@PEAVCommonOperatorBuilder@123@PEAVLoopTree@123@PEAVZone@23@PEAVSourcePositionTable@123@PEAVNodeOriginTable@123@@Z	743	0x140f0a170
??0MachineGraph@compiler@internal@v8@@QEAA@PEAVGraph@123@PEAVCommonOperatorBuilder@123@PEAVMachineOperatorBuilder@123@@Z	744	0x140ed32c0
??0MachineOperatorBuilder@compiler@internal@v8@@QEAA@PEAVZone@23@W4MachineRepresentation@23@V?$Flags@W4Flag@MachineOperatorBuilder@compiler@internal@v8@@I@base@3@VAlignmentRequirements@0123@@Z	745	0x140eb9610
??0MachineOperatorReducer@compiler@internal@v8@@QEAA@AEBV0123@@Z	746	0x140f0a1a0
??0MachineOperatorReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVMachineGraph@123@_N@Z	747	0x141044910
??0MacroAssembler@internal@v8@@QEAA@PEAVIsolate@12@AEBUAssemblerOptions@12@W4CodeObjectRequired@12@@Z	748	0x14049b090
??0MacroAssembler@internal@v8@@QEAA@PEAVIsolate@12@AEBUAssemblerOptions@12@W4CodeObjectRequired@12@V?$unique_ptr@VAssemblerBuffer@internal@v8@@U?$default_delete@VAssemblerBuffer@internal@v8@@@std@@@std@@@Z	749	0x14049b0d0
??0MacroAssembler@internal@v8@@QEAA@PEAVIsolate@12@W4CodeObjectRequired@12@@Z	750	0x14049b130
??0MacroAssembler@internal@v8@@QEAA@PEAVIsolate@12@W4CodeObjectRequired@12@V?$unique_ptr@VAssemblerBuffer@internal@v8@@U?$default_delete@VAssemblerBuffer@internal@v8@@@std@@@std@@@Z	751	0x14049b160
??0MapRef@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@PEAVObjectData@123@_N@Z	752	0x1404ba8b0
??0MapUpdater@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VMap@internal@v8@@@12@@Z	753	0x140815f50
??0Marker@internal@cppgc@@QEAA@VKey@MarkerBase@12@AEAVHeapBase@12@PEAVPlatform@2@UMarkingConfig@412@@Z	754	0x14045cb80
??0MarkerBase@internal@cppgc@@IEAA@VKey@012@AEAVHeapBase@12@PEAVPlatform@2@UMarkingConfig@012@@Z	755	0x14045cc80
??0MarkingVerifier@internal@cppgc@@QEAA@AEAVHeapBase@12@@Z	756	0x14045aca0
??0MarkingVerifierBase@internal@cppgc@@IEAA@AEAVHeapBase@12@AEAVVerificationState@12@V?$unique_ptr@VVisitor@cppgc@@U?$default_delete@VVisitor@cppgc@@@std@@@std@@@Z	757	0x14045ad20
??0MarkingVisitorBase@internal@cppgc@@QEAA@AEAVHeapBase@12@AEAVMarkingStateBase@12@@Z	758	0x14045a1b0
??0MarkingWorklists@internal@v8@@QEAA@XZ	759	0x14047cc60
??0MeasureMemoryDelegate@internal@v8@@QEAA@AEBV012@@Z	760	0x140970dc0
??0MeasureMemoryDelegate@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VNativeContext@internal@v8@@@12@V?$Handle@VJSPromise@internal@v8@@@12@W4MeasureMemoryMode@2@@Z	761	0x140970df0
??0MeasureMemoryDelegate@v8@@QEAA@AEBV01@@Z	762	0x140079b20
??0MeasureMemoryDelegate@v8@@QEAA@XZ	763	0x140079b20
??0MemoryAllocator@internal@v8@@QEAA@PEAVIsolate@12@PEAVPageAllocator@2@_K@Z	764	0x1409743f0
??0MemoryMappedFile@OS@base@v8@@QEAA@AEBV0123@@Z	765	0x140079b20
??0MemoryMappedFile@OS@base@v8@@QEAA@XZ	766	0x140079b20
??0MemoryReducer@internal@v8@@QEAA@PEAVHeap@12@@Z	767	0x140970540
??0MemoryRegion@internal@cppgc@@QEAA@PEAE_K@Z	768	0x140450cf0
??0MemoryRegion@internal@cppgc@@QEAA@XZ	769	0x140079750
??0MessageLocation@internal@v8@@QEAA@V?$Handle@VScript@internal@v8@@@12@HH@Z	770	0x140a03880
??0MessageLocation@internal@v8@@QEAA@V?$Handle@VScript@internal@v8@@@12@HHV?$Handle@VSharedFunctionInfo@internal@v8@@@12@@Z	771	0x140a038a0
??0MessageLocation@internal@v8@@QEAA@V?$Handle@VScript@internal@v8@@@12@V?$Handle@VSharedFunctionInfo@internal@v8@@@12@H@Z	772	0x140a038c0
??0MessageLocation@internal@v8@@QEAA@XZ	773	0x140a038e0
??0MicrotaskQueue@internal@v8@@AEAA@XZ	774	0x140a02bb0
??0MicrotaskQueue@v8@@AEAA@XZ	775	0x1400798f0
??0MicrotasksScope@v8@@QEAA@PEAVIsolate@1@PEAVMicrotaskQueue@1@W4Type@01@@Z	776	0x140b068b0
??0MicrotasksScope@v8@@QEAA@PEAVIsolate@1@W4Type@01@@Z	777	0x140b068e0
??0ModuleWireBytes@wasm@internal@v8@@QEAA@PEBE0@Z	778	0x14047ccf0
??0ModuleWireBytes@wasm@internal@v8@@QEAA@V?$Vector@$$CBE@base@3@@Z	779	0x140079760
??0MoveOperands@compiler@internal@v8@@QEAA@AEBVInstructionOperand@123@0@Z	780	0x1404ba910
??0MoveOptimizer@compiler@internal@v8@@QEAA@PEAVZone@23@PEAVInstructionSequence@123@@Z	781	0x140f764c0
??0MultiIsolatePlatform@node@@QEAA@AEBV01@@Z	782	0x14007a130
??0MultiIsolatePlatform@node@@QEAA@XZ	783	0x14007a130
??0MutatorMarkingVisitor@internal@cppgc@@QEAA@AEAVHeapBase@12@AEAVMutatorMarkingState@12@@Z	784	0x14045a1d0
??0MutatorUnifiedHeapMarkingVisitor@internal@v8@@QEAA@AEAVHeapBase@1cppgc@@AEAVMutatorMarkingState@14@AEAVUnifiedHeapMarkingState@12@@Z	785	0x1409e6670
??0MutatorUnifiedHeapMarkingVisitor@internal@v8@@QEAA@AEBV012@@Z	786	0x1409e6690
??0Mutex@base@v8@@QEAA@XZ	787	0x1400fba60
??0NameConverter@disasm@@QEAA@XZ	788	0x1404b0030
??0NameDictionary@internal@v8@@IEAA@_K@Z	789	0x140078b40
??0NameDictionary@internal@v8@@QEAA@XZ	790	0x1400fba60
??0NameProvider@cppgc@@QEAA@AEBV01@@Z	791	0x140079fd0
??0NameProvider@cppgc@@QEAA@XZ	792	0x140079fd0
??0NativeContextStats@internal@v8@@QEAA@$$QEAV012@@Z	793	0x14047cd10
??0NativeContextStats@internal@v8@@QEAA@AEBV012@@Z	794	0x14047cdf0
??0NativeContextStats@internal@v8@@QEAA@XZ	795	0x14047ce80
??0NativeModule@wasm@internal@v8@@AEAA@AEBVWasmFeatures@123@VVirtualMemory@23@V?$shared_ptr@$$CBUWasmModule@wasm@internal@v8@@@std@@V?$shared_ptr@VCounters@internal@v8@@@7@PEAV?$shared_ptr@VNativeModule@wasm@internal@v8@@@7@@Z	796	0x140565d10
??0NativeModuleDeserializer@wasm@internal@v8@@QEAA@PEAVNativeModule@123@@Z	797	0x140527b60
??0NativeModuleSerializer@wasm@internal@v8@@QEAA@PEBVNativeModule@123@V?$Vector@QEAVWasmCode@wasm@internal@v8@@@base@3@@Z	798	0x140527b90
??0NewSpace@internal@v8@@QEAA@PEAVHeap@12@PEAVPageAllocator@2@_K2@Z	799	0x14096ea30
??0NexusConfig@internal@v8@@AEAA@PEAVIsolate@12@@Z	800	0x14047cef0
??0NexusConfig@internal@v8@@AEAA@PEAVIsolate@12@PEAVLocalHeap@12@@Z	801	0x140450cf0
??0NoDumpOnJavascriptExecution@internal@v8@@QEAA@PEAVIsolate@12@@Z	802	0x140a7d880
??0NoGarbageCollectionScope@subtle@cppgc@@QEAA@AEAVHeapHandle@2@@Z	803	0x140464fd0
??0NoThrowOnJavascriptExecution@internal@v8@@QEAA@PEAVIsolate@12@@Z	804	0x140a7d8a0
??0Node@compiler@internal@v8@@AEAA@IPEBVOperator@123@HH@Z	805	0x140ea2470
??0NodeOriginTable@compiler@internal@v8@@QEAA@PEAVGraph@123@@Z	806	0x140f6c660
??0NormalPage@internal@cppgc@@AEAA@AEAVHeapBase@12@AEAVBaseSpace@12@@Z	807	0x1404646c0
??0NormalPageMemoryPool@internal@cppgc@@QEAA@AEBV012@@Z	808	0x140450d00
??0NormalPageMemoryPool@internal@cppgc@@QEAA@XZ	809	0x1404581b0
??0NormalPageMemoryRegion@internal@cppgc@@QEAA@PEAVPageAllocator@v8@@@Z	810	0x1404582e0
??0NormalPageSpace@internal@cppgc@@QEAA@PEAVRawHeap@12@_K_N@Z	811	0x140464510
??0OFStream@internal@v8@@QEAA@PEAU_iobuf@@@Z	812	0x1406b3970
??0OFStreamBase@internal@v8@@QEAA@AEBV012@@Z	813	0x14047cf00
??0OFStreamBase@internal@v8@@QEAA@PEAU_iobuf@@@Z	814	0x1406b3aa0
??0OSROptimizedCodeCache@internal@v8@@IEAA@_K@Z	815	0x140078b40
??0OSROptimizedCodeCache@internal@v8@@QEAA@XZ	816	0x1400fba60
??0ObjectAllocator@internal@cppgc@@QEAA@PEAVRawHeap@12@PEAVPageBackend@12@PEAVStatsCollector@12@@Z	817	0x14044f620
??0ObjectHashSet@internal@v8@@IEAA@_K@Z	818	0x140078b40
??0ObjectHashSet@internal@v8@@QEAA@XZ	819	0x1400fba60
??0ObjectHashTable@internal@v8@@IEAA@_K@Z	820	0x140078b40
??0ObjectHashTable@internal@v8@@QEAA@XZ	821	0x1400fba60
??0ObjectIterator@internal@v8@@QEAA@AEBV012@@Z	822	0x14047cf40
??0ObjectIterator@internal@v8@@QEAA@XZ	823	0x14047cf40
??0ObjectRef@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@PEAVObjectData@123@_N@Z	824	0x1404ba930
??0ObjectStartBitmap@internal@cppgc@@QEAA@PEAE@Z	825	0x14044f5d0
??0Operand@internal@v8@@QEAA@PEAVLabel@12@H@Z	826	0x14049b1c0
??0Operand@internal@v8@@QEAA@V012@H@Z	827	0x14050c030
??0Operand@internal@v8@@QEAA@VRegister@12@0W4ScaleFactor@12@H@Z	828	0x14049b1e0
??0Operand@internal@v8@@QEAA@VRegister@12@H@Z	829	0x14049b270
??0Operand@internal@v8@@QEAA@VRegister@12@W4ScaleFactor@12@H@Z	830	0x14049b350
??0OperationTyper@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@PEAVZone@23@@Z	831	0x1410a0690
??0OperationsBarrier@internal@v8@@QEAA@XZ	832	0x14047cf50
??0Operator@compiler@internal@v8@@QEAA@GV?$Flags@W4Property@Operator@compiler@internal@v8@@E@base@3@PEBD_K22222@Z	833	0x140f383b0
??0OptimizedCompilationInfo@internal@v8@@QEAA@PEAVZone@12@PEAVIsolate@12@V?$Handle@VSharedFunctionInfo@internal@v8@@@12@V?$Handle@VJSFunction@internal@v8@@@12@W4CodeKind@12@@Z	834	0x1404e2fc0
??0OptimizedCompilationInfo@internal@v8@@QEAA@PEAVZone@12@PEAVIsolate@12@V?$Handle@VSharedFunctionInfo@internal@v8@@@12@V?$Handle@VJSFunction@internal@v8@@@12@W4CodeKind@12@VBytecodeOffset@12@PEAVJavaScriptFrame@12@@Z	835	0x140a82310
??0OptimizedCompilationInfo@internal@v8@@QEAA@V?$Vector@$$CBD@base@2@PEAVZone@12@W4CodeKind@12@@Z	836	0x140a82510
??0OptimizingCompileDispatcher@internal@v8@@QEAA@PEAVIsolate@12@@Z	837	0x1406e2460
??0OrderedHashMap@internal@v8@@IEAA@_K@Z	838	0x140078b40
??0OrderedHashMap@internal@v8@@QEAA@XZ	839	0x1400fba60
??0OrderedHashSet@internal@v8@@IEAA@_K@Z	840	0x140078b40
??0OrderedHashSet@internal@v8@@QEAA@XZ	841	0x1400fba60
??0OrderedNameDictionary@internal@v8@@IEAA@_K@Z	842	0x140078b40
??0OrderedNameDictionary@internal@v8@@QEAA@XZ	843	0x1400fba60
??0OutputStream@v8@@QEAA@AEBV01@@Z	844	0x14007a070
??0OutputStream@v8@@QEAA@XZ	845	0x14007a070
??0OverrideEmbedderStackStateScope@testing@cppgc@@QEAA@AEAVHeapHandle@2@W4EmbedderStackState@2@@Z	846	0x1404516b0
??0PageAllocator@base@v8@@QEAA@AEBV012@@Z	847	0x140e63590
??0PageAllocator@base@v8@@QEAA@XZ	848	0x140e635b0
??0PageBackend@internal@cppgc@@QEAA@PEAVPageAllocator@v8@@@Z	849	0x140458370
??0PageMemory@internal@cppgc@@QEAA@VMemoryRegion@12@0@Z	850	0x140450dc0
??0PageMemoryRegion@internal@cppgc@@IEAA@PEAVPageAllocator@v8@@VMemoryRegion@12@_N@Z	851	0x140458450
??0PageMemoryRegionTree@internal@cppgc@@QEAA@AEBV012@@Z	852	0x140450de0
??0PageMemoryRegionTree@internal@cppgc@@QEAA@XZ	853	0x140458470
??0PagedSpace@internal@v8@@QEAA@PEAVHeap@12@W4AllocationSpace@12@W4Executability@12@PEAVFreeList@12@W4CompactionSpaceKind@12@@Z	854	0x140964200
??0PagedSpaceIterator@internal@v8@@QEAA@PEAVHeap@12@@Z	855	0x14047cf80
??0PagedSpaceObjectIterator@internal@v8@@QEAA@$$QEAV012@@Z	856	0x14047cf90
??0PagedSpaceObjectIterator@internal@v8@@QEAA@AEBV012@@Z	857	0x14047cf90
??0PagedSpaceObjectIterator@internal@v8@@QEAA@PEAVHeap@12@PEAVPagedSpace@12@@Z	858	0x1409642f0
??0PagedSpaceObjectIterator@internal@v8@@QEAA@PEAVHeap@12@PEAVPagedSpace@12@PEAVPage@12@@Z	859	0x140964350
??0ParallelMove@compiler@internal@v8@@QEAA@PEAVZone@23@@Z	860	0x1404b9c40
??0ParseInfo@internal@v8@@AEAA@VUnoptimizedCompileFlags@12@PEAVUnoptimizedCompileState@12@@Z	861	0x1407b21a0
??0ParseInfo@internal@v8@@QEAA@PEAVIsolate@12@VUnoptimizedCompileFlags@12@PEAVUnoptimizedCompileState@12@@Z	862	0x1407b2270
??0Parser@internal@v8@@QEAA@PEAVParseInfo@12@@Z	863	0x1407a32f0
??0PauseAllocationObserversScope@internal@v8@@QEAA@PEAVHeap@12@@Z	864	0x1409f34e0
??0PersistentHandleVisitor@v8@@QEAA@AEBV01@@Z	865	0x140079aa0
??0PersistentHandleVisitor@v8@@QEAA@XZ	866	0x140079aa0
??0PersistentHandles@internal@v8@@QEAA@PEAVIsolate@12@@Z	867	0x1409f3bc0
??0PersistentHandlesScope@internal@v8@@QEAA@PEAVIsolate@12@@Z	868	0x1409f3c40
??0PersistentRegion@internal@cppgc@@QEAA@XZ	869	0x14044f4f0
??0PersistentRegionLock@internal@cppgc@@QEAA@XZ	870	0x140457530
??0PhiInstruction@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	871	0x1404ba960
??0PhiInstruction@compiler@internal@v8@@QEAA@AEBV0123@@Z	872	0x1404ba9b0
??0PhiInstruction@compiler@internal@v8@@QEAA@PEAVZone@23@H_K@Z	873	0x140ea41d0
??0Platform@cppgc@@QEAA@AEBV01@@Z	874	0x14044f600
??0Platform@cppgc@@QEAA@XZ	875	0x14044f600
??0PlatformAwareObjectStartBitmap@internal@cppgc@@QEAA@PEAE@Z	876	0x14044f5d0
??0PreparseDataBuilder@internal@v8@@QEAA@PEAVZone@12@PEAV012@PEAV?$vector@PEAXV?$allocator@PEAX@std@@@std@@@Z	877	0x14079fcb0
??0ProcessingScope@LocalEmbedderHeapTracer@internal@v8@@QEAA@AEBV0123@@Z	878	0x1409523a0
??0ProcessingScope@LocalEmbedderHeapTracer@internal@v8@@QEAA@PEAV123@@Z	879	0x1409e5ec0
??0ProfileNode@internal@v8@@QEAA@PEAVProfileTree@12@PEAVCodeEntry@12@PEAV012@H@Z	880	0x140749d90
??0ProfileTree@internal@v8@@QEAA@PEAVIsolate@12@PEAVCodeEntryStorage@12@@Z	881	0x14074cf30
??0ProfilerCodeObserver@internal@v8@@QEAA@PEAVIsolate@12@AEAVCodeEntryStorage@12@@Z	882	0x140760510
??0ProfilerEventsProcessor@internal@v8@@IEAA@PEAVIsolate@12@PEAVSymbolizer@12@PEAVProfilerCodeObserver@12@@Z	883	0x140760570
??0ProfilerListener@internal@v8@@QEAA@PEAVIsolate@12@PEAVCodeEventObserver@12@AEAVCodeEntryStorage@12@AEAVWeakCodeRegistry@12@W4CpuProfilingNamingMode@2@@Z	884	0x140749f60
??0PropertyDescriptor@v8@@QEAA@V?$Local@VValue@v8@@@1@0@Z	885	0x140b06910
??0PropertyDescriptor@v8@@QEAA@V?$Local@VValue@v8@@@1@@Z	886	0x140b06970
??0PropertyDescriptor@v8@@QEAA@V?$Local@VValue@v8@@@1@_N@Z	887	0x140b069c0
??0PropertyDescriptor@v8@@QEAA@XZ	888	0x140b06a30
??0PropertyIterator@debug@v8@@QEAA@AEBV012@@Z	889	0x14047cfd0
??0PropertyIterator@debug@v8@@QEAA@XZ	890	0x14047cfd0
??0RandomNumberGenerator@base@v8@@QEAA@XZ	891	0x140e68d70
??0RandomNumberGenerator@base@v8@@QEAA@_J@Z	892	0x140e5f610
??0RawHeap@internal@cppgc@@QEAA@PEAVHeapBase@12@AEBV?$vector@V?$unique_ptr@VCustomSpaceBase@cppgc@@U?$default_delete@VCustomSpaceBase@cppgc@@@std@@@std@@V?$allocator@V?$unique_ptr@VCustomSpaceBase@cppgc@@U?$default_delete@VCustomSpaceBase@cppgc@@@std@@@std@@@2@@std@@@Z	893	0x1404566c0
??0RawMachineAssembler@compiler@internal@v8@@QEAA@PEAVIsolate@23@PEAVGraph@123@PEAVCallDescriptor@123@W4MachineRepresentation@23@V?$Flags@W4Flag@MachineOperatorBuilder@compiler@internal@v8@@I@base@3@VAlignmentRequirements@MachineOperatorBuilder@123@W4PoisoningMitigationLevel@23@@Z	894	0x14108bcb0
??0RawMachineLabel@compiler@internal@v8@@QEAA@W4Type@0123@@Z	895	0x140f1ce00
??0ReadOnlyHeapObjectIterator@internal@v8@@QEAA@PEAVReadOnlyHeap@12@@Z	896	0x1409636b0
??0ReadOnlyHeapObjectIterator@internal@v8@@QEAA@PEAVReadOnlySpace@12@@Z	897	0x1409636f0
??0ReadOnlySerializer@internal@v8@@QEAA@PEAVIsolate@12@V?$Flags@W4SerializerFlag@Snapshot@internal@v8@@H@base@2@@Z	898	0x1406ccc00
??0ReadOnlySpace@internal@v8@@QEAA@PEAVHeap@12@@Z	899	0x140962b80
??0Recorder@metrics@v8@@QEAA@AEBV012@@Z	900	0x14047cfe0
??0Recorder@metrics@v8@@QEAA@XZ	901	0x14047cfe0
??0RecursiveMutex@base@v8@@QEAA@XZ	902	0x140e5f160
??0Reducer@compiler@internal@v8@@QEAA@AEBV0123@@Z	903	0x140e816b0
??0Reducer@compiler@internal@v8@@QEAA@XZ	904	0x140e816b0
??0RedundancyElimination@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVZone@23@@Z	905	0x14104d570
??0RegExpBytecodeGenerator@internal@v8@@QEAA@PEAVIsolate@12@PEAVZone@12@@Z	906	0x14073c4b0
??0RegExpMacroAssemblerX64@internal@v8@@QEAA@PEAVIsolate@12@PEAVZone@12@W4Mode@NativeRegExpMacroAssembler@12@H@Z	907	0x1404aa280
??0RegExpParser@internal@v8@@QEAA@PEAVFlatStringReader@12@V?$Flags@W4Flag@JSRegExp@internal@v8@@H@base@2@PEAVIsolate@12@PEAVZone@12@@Z	908	0x14071b860
??0RegionAllocator@base@v8@@QEAA@_K00@Z	909	0x140e6c5c0
??0Register@interpreter@internal@v8@@QEAA@H@Z	910	0x14047cff0
??0RegisterConfiguration@internal@v8@@QEAA@AEBV012@@Z	911	0x140500910
??0RegisterConfiguration@internal@v8@@QEAA@HHHHPEBH0W4AliasingKind@012@@Z	912	0x140a81230
??0RegisterState@v8@@QEAA@AEBU01@@Z	913	0x140b06a80
??0RegisterState@v8@@QEAA@XZ	914	0x14044f4f0
??0RelocIterator@internal@v8@@AEAA@VCode@12@_K1PEBE2H@Z	915	0x140a80110
??0RelocIterator@internal@v8@@QEAA@AEBVCodeDesc@12@H@Z	916	0x140a80160
??0RelocIterator@internal@v8@@QEAA@PEAVEmbeddedData@12@VCode@12@H@Z	917	0x140a801c0
??0RelocIterator@internal@v8@@QEAA@V?$Vector@E@base@2@V?$Vector@$$CBE@42@_KH@Z	918	0x140a80430
??0RelocIterator@internal@v8@@QEAA@VCode@12@H@Z	919	0x140a80490
??0RelocIterator@internal@v8@@QEAA@VCode@12@VByteArray@12@H@Z	920	0x140a804b0
??0RelocIterator@internal@v8@@QEAA@VCodeReference@12@H@Z	921	0x140a80580
??0RemoteObject@API@Runtime@protocol@v8_inspector@@QEAA@$$QEAV01234@@Z	922	0x14042dea0
??0RemoteObject@API@Runtime@protocol@v8_inspector@@QEAA@AEBV01234@@Z	923	0x14042dea0
??0RemoteObject@API@Runtime@protocol@v8_inspector@@QEAA@XZ	924	0x14042dea0
??0RepresentationChanger@compiler@internal@v8@@QEAA@PEAVJSGraph@123@PEAVJSHeapBroker@123@@Z	925	0x1410a4de0
??0ResourceConstraints@v8@@QEAA@XZ	926	0x140079870
??0ResumeJumpTarget@compiler@internal@v8@@AEAA@HHH@Z	927	0x140b06610
??0RuntimeCallStats@internal@v8@@QEAA@W4ThreadType@012@@Z	928	0x140078ac0
??0SafeForTerminationScope@Isolate@v8@@QEAA@PEAV12@@Z	929	0x140b06b10
??0SafepointScope@internal@v8@@QEAA@PEAVHeap@12@@Z	930	0x1409624f0
??0Sampler@sampler@v8@@QEAA@PEAVIsolate@2@@Z	931	0x1408dfd50
??0SamplingEventsProcessor@internal@v8@@QEAA@PEAVIsolate@12@PEAVSymbolizer@12@PEAVProfilerCodeObserver@12@PEAVCpuProfilesCollection@12@VTimeDelta@base@2@_N@Z	932	0x1407606e0
??0SaveAndSwitchContext@internal@v8@@QEAA@PEAVIsolate@12@VContext@12@@Z	933	0x140a0a430
??0SaveContext@internal@v8@@QEAA@PEAVIsolate@12@@Z	934	0x140a0a470
??0Scanner@internal@v8@@QEAA@PEAVUtf16CharacterStream@12@VUnoptimizedCompileFlags@12@@Z	935	0x140764b10
??0Schedule@compiler@internal@v8@@QEAA@PEAVZone@23@_K@Z	936	0x140ee1220
??0ScheduledErrorThrower@wasm@internal@v8@@QEAA@PEAVIsolate@23@PEBD@Z	937	0x140523620
??0Scheduler@compiler@internal@v8@@AEAA@PEAVZone@23@PEAVGraph@123@PEAVSchedule@123@V?$Flags@W4Flag@Scheduler@compiler@internal@v8@@H@base@3@_KPEAVTickCounter@23@PEBVProfileDataFromFile@23@@Z	938	0x14104ef30
??0Scheduler@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	939	0x140f0b600
??0Scheduler@compiler@internal@v8@@QEAA@AEBV0123@@Z	940	0x140f0b740
??0Scope@GCTracer@internal@v8@@QEAA@PEAV123@W4ScopeId@0123@W4ThreadKind@23@@Z	941	0x1409c8020
??0Scope@Isolate@v8@@QEAA@PEAV12@@Z	942	0x140078f10
??0Scope@internal@v8@@AEAA@PEAVZone@12@PEBVAstRawString@12@W4MaybeAssignedFlag@12@V?$Handle@VScopeInfo@internal@v8@@@12@@Z	943	0x140af1d20
??0Scope@internal@v8@@AEAA@PEAVZone@12@W4ScopeType@12@PEAVAstValueFactory@12@V?$Handle@VScopeInfo@internal@v8@@@12@@Z	944	0x140af1e50
??0Scope@internal@v8@@IEAA@PEAVZone@12@@Z	945	0x140af1f90
??0Scope@internal@v8@@QEAA@$$QEAV012@@Z	946	0x1406ea7b0
??0Scope@internal@v8@@QEAA@PEAVZone@12@PEAV012@W4ScopeType@12@@Z	947	0x140af2010
??0ScopeIterator@debug@v8@@QEAA@XZ	948	0x14047cfd0
??0ScopedExceptionHandler@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@PEAV?$CodeAssemblerParameterizedLabel@VObject@internal@v8@@@123@@Z	949	0x140f1ce20
??0ScopedExceptionHandler@compiler@internal@v8@@QEAA@PEAVCodeAssembler@123@PEAVCodeAssemblerLabel@123@PEAV?$TypedCodeAssemblerVariable@VObject@internal@v8@@@123@@Z	950	0x140f1ce90
??0ScriptData@Coverage@debug@v8@@AEAA@_KV?$shared_ptr@VCoverage@internal@v8@@@std@@@Z	951	0x140a6d8c0
??0ScriptData@Coverage@debug@v8@@QEAA@$$QEAV0123@@Z	952	0x14047bda0
??0ScriptData@TypeProfile@debug@v8@@AEAA@_KV?$shared_ptr@VTypeProfile@internal@v8@@@std@@@Z	953	0x140a6d8c0
??0ScriptData@TypeProfile@debug@v8@@QEAA@$$QEAV0123@@Z	954	0x14047bda0
??0ScriptData@internal@v8@@QEAA@PEBEH@Z	955	0x1406dad80
??0ScriptIterator@SharedFunctionInfo@internal@v8@@QEAA@PEAVIsolate@23@VScript@23@@Z	956	0x1407d68f0
??0ScriptStreamingTask@ScriptCompiler@v8@@AEAA@PEAUScriptStreamingData@internal@2@@Z	957	0x140078b40
??0SealHandleScope@v8@@QEAA@PEAVIsolate@1@@Z	958	0x140b06b30
??0SearchMatch@API@Debugger@protocol@v8_inspector@@QEAA@$$QEAV01234@@Z	959	0x14042dea0
??0SearchMatch@API@Debugger@protocol@v8_inspector@@QEAA@AEBV01234@@Z	960	0x14042dea0
??0SearchMatch@API@Debugger@protocol@v8_inspector@@QEAA@XZ	961	0x14042dea0
??0SegmentBase@internal@base@heap@@QEAA@G@Z	962	0x14044f610
??0Semaphore@base@v8@@QEAA@H@Z	963	0x140e68720
??0SetupIsolateDelegate@internal@v8@@QEAA@AEBV012@@Z	964	0x1408f0900
??0SetupIsolateDelegate@internal@v8@@QEAA@_N@Z	965	0x1408f0920
??0SharedFunctionInfoRef@compiler@internal@v8@@QEAA@PEAVJSHeapBroker@123@PEAVObjectData@123@_N@Z	966	0x1404baa80
??0SharedMemoryStatistics@v8@@QEAA@XZ	967	0x14007b730
??0SharedMutex@base@v8@@QEAA@XZ	968	0x1400fba60
??0SharedTurboAssembler@internal@v8@@QEAA@PEAVIsolate@12@AEBUAssemblerOptions@12@W4CodeObjectRequired@12@@Z	969	0x14049b380
??0SharedTurboAssembler@internal@v8@@QEAA@PEAVIsolate@12@AEBUAssemblerOptions@12@W4CodeObjectRequired@12@V?$unique_ptr@VAssemblerBuffer@internal@v8@@U?$default_delete@VAssemblerBuffer@internal@v8@@@std@@@std@@@Z	970	0x14049b3c0
??0SharedTurboAssembler@internal@v8@@QEAA@PEAVIsolate@12@W4CodeObjectRequired@12@@Z	971	0x14049b420
??0SharedTurboAssembler@internal@v8@@QEAA@PEAVIsolate@12@W4CodeObjectRequired@12@V?$unique_ptr@VAssemblerBuffer@internal@v8@@U?$default_delete@VAssemblerBuffer@internal@v8@@@std@@@std@@@Z	972	0x14049b4a0
??0SignatureMap@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	973	0x14047d000
??0SignatureMap@wasm@internal@v8@@QEAA@XZ	974	0x14047d0f0
??0SimplifiedLowering@compiler@internal@v8@@QEAA@PEAVJSGraph@123@PEAVJSHeapBroker@123@PEAVZone@23@PEAVSourcePositionTable@123@PEAVNodeOriginTable@123@W4PoisoningMitigationLevel@23@PEAVTickCounter@23@PEAVLinkage@123@PEAVObserveNodeManager@123@@Z	975	0x14106c710
??0SimplifiedOperatorBuilder@compiler@internal@v8@@QEAA@PEAVZone@23@@Z	976	0x140f44380
??0SimplifiedOperatorReducer@compiler@internal@v8@@QEAA@PEAVEditor@AdvancedReducer@123@PEAVJSGraph@123@PEAVJSHeapBroker@123@@Z	977	0x141074160
??0SnapshotCreator@v8@@QEAA@PEAVIsolate@1@PEB_JPEAVStartupData@1@@Z	978	0x140b06b70
??0SnapshotCreator@v8@@QEAA@PEB_JPEAVStartupData@1@@Z	979	0x140b06c70
??0SnapshotData@internal@v8@@IEAA@XZ	980	0x140527bb0
??0SnapshotData@internal@v8@@QEAA@$$QEAV012@@Z	981	0x140527bd0
??0SnapshotData@internal@v8@@QEAA@PEBVSerializer@12@@Z	982	0x1406c46a0
??0SnapshotData@internal@v8@@QEAA@V?$Vector@$$CBE@base@2@@Z	983	0x140527c10
??0SourceIdAssigner@compiler@internal@v8@@QEAA@$$QEAV0123@@Z	984	0x140eeb000
??0SourceIdAssigner@compiler@internal@v8@@QEAA@AEBV0123@@Z	985	0x140eeb060
??0SourceIdAssigner@compiler@internal@v8@@QEAA@_K@Z	986	0x140eeb160
??0SourceLocation@cppgc@@AEAA@PEBD0_K@Z	987	0x14044f620
??0SourceLocation@cppgc@@QEAA@XZ	988	0x14007b730
??0SourcePositionTable@compiler@internal@v8@@QEAA@PEAVGraph@123@@Z	989	0x140f53de0
??0SourcePositionTable@internal@v8@@QEAA@XZ	990	0x14007b730
??0SourcePositionTableBuilder@internal@v8@@QEAA@$$QEAV012@@Z	991	0x14047d160
??0SourcePositionTableBuilder@internal@v8@@QEAA@AEBV012@@Z	992	0x14047d1b0
??0SourcePositionTableBuilder@internal@v8@@QEAA@PEAVZone@12@W4RecordingMode@012@@Z	993	0x140a7ef20
??0SourcePositionTableIterator@internal@v8@@QEAA@V?$Handle@VByteArray@internal@v8@@@12@W4IterationFilter@012@W4FunctionEntryFilter@012@@Z	994	0x140a7ef50
??0SourcePositionTableIterator@internal@v8@@QEAA@V?$Vector@$$CBE@base@2@W4IterationFilter@012@W4FunctionEntryFilter@012@@Z	995	0x140a7efb0
??0SourcePositionTableIterator@internal@v8@@QEAA@VByteArray@12@W4IterationFilter@012@W4FunctionEntryFilter@012@@Z	996	0x140a7f010
??0Space@internal@v8@@QEAA@PEAVHeap@12@W4AllocationSpace@12@PEAVFreeList@12@@Z	997	0x14047d2a0
??0SpaceIterator@internal@v8@@QEAA@AEBV012@@Z	998	0x14047d400
??0SpaceIterator@internal@v8@@QEAA@PEAVHeap@12@@Z	999	0x1409add90
??0Stack@base@heap@@QEAA@PEBX@Z	1000	0x140078b40
??0StackFrameIterator@internal@v8@@QEAA@PEAVIsolate@12@@Z	1001	0x140a1f9f0
??0StackFrameIterator@internal@v8@@QEAA@PEAVIsolate@12@PEAVThreadLocalTop@12@@Z	1002	0x140a1fa10
??0StackGuard@internal@v8@@QEAA@PEAVIsolate@12@@Z	1003	0x14047d420
??0StackTrace@API@Runtime@protocol@v8_inspector@@QEAA@$$QEAV01234@@Z	1004	0x14042dea0
??0StackTrace@API@Runtime@protocol@v8_inspector@@QEAA@AEBV01234@@Z	1005	0x14042dea0
??0StackTrace@API@Runtime@protocol@v8_inspector@@QEAA@XZ	1006	0x14042dea0
??0StackTrace@debug@base@v8@@QEAA@PEAU_EXCEPTION_POINTERS@@@Z	1007	0x140e6ae80
??0StackTrace@debug@base@v8@@QEAA@PEBQEBX_K@Z	1008	0x140e6c070
??0StackTrace@debug@base@v8@@QEAA@PEBU_CONTEXT@@@Z	1009	0x140e6aea0
??0StackTrace@debug@base@v8@@QEAA@XZ	1010	0x140e6aec0
??0StackTraceFrameIterator@internal@v8@@QEAA@PEAVIsolate@12@@Z	1011	0x140a20110
??0StackTraceFrameIterator@internal@v8@@QEAA@PEAVIsolate@12@W4StackFrameId@12@@Z	1012	0x140a20170
??0StackTraceId@API@Runtime@protocol@v8_inspector@@QEAA@$$QEAV01234@@Z	1013	0x14042dea0
??0StackTraceId@API@Runtime@protocol@v8_inspector@@QEAA@AEBV01234@@Z	1014	0x14042dea0
??0StackTraceId@API@Runtime@protocol@v8_inspector@@QEAA@XZ	1015	0x14042dea0
??0StackTraceIterator@debug@v8@@QEAA@XZ	1016	0x14047d460
??0StandaloneTestingHeap@testing@cppgc@@QEAA@AEAVHeapHandle@2@@Z	1017	0x140078b40
??0StartupSerializer@internal@v8@@QEAA@PEAVIsolate@12@V?$Flags@W4SerializerFlag@Snapshot@internal@v8@@H@base@2@PEAVReadOnlySerializer@12@@Z	1018	0x1406c0670
??0StateValuesAccess@compiler@internal@v8@@QEAA@PEAVNode@123@@Z	1019	0x140078b40
??0StateValuesCache@compiler@internal@v8@@QEAA@PEAVJSGraph@123@@Z	1020	0x140f56be0
??0StatsCollector@internal@cppgc@@QEAA@PEAVPlatform@2@@Z	1021	0x140455750
??0StatsCounterThreadSafe@internal@v8@@AEAA@PEAVCounters@12@PEBD@Z	1022	0x1408dca20
??0StatsScope@ZoneStats@compiler@internal@v8@@QEAA@PEAV1234@@Z	1023	0x14104c3f0
??0StreamedSource@ScriptCompiler@v8@@QEAA@PEAVExternalSourceStream@12@W4Encoding@012@@Z	1024	0x140b06cc0
??0StreamedSource@ScriptCompiler@v8@@QEAA@V?$unique_ptr@VExternalSourceStream@ScriptCompiler@v8@@U?$default_delete@VExternalSourceStream@ScriptCompiler@v8@@@std@@@std@@W4Encoding@012@@Z	1025	0x140b06cf0
??0StreamingDecoder@wasm@internal@v8@@QEAA@AEBV0123@@Z	1026	0x140543c10
??0StreamingDecoder@wasm@internal@v8@@QEAA@XZ	1027	0x140543c80
??0StreamingProcessor@wasm@internal@v8@@QEAA@AEBV0123@@Z	1028	0x140543cb0
??0StreamingProcessor@wasm@internal@v8@@QEAA@XZ	1029	0x140543cb0
??0String16@v8_inspector@@QEAA@PEBD@Z	1030	0x14069d4d0
??0String16@v8_inspector@@QEAA@PEBG@Z	1031	0x14069d600
??0StringBuffer@v8_inspector@@QEAA@AEBV01@@Z	1032	0x140079fd0
??0StringBuffer@v8_inspector@@QEAA@XZ	1033	0x140079fd0
??0StringTable@internal@v8@@QEAA@PEAVIsolate@12@@Z	1034	0x1407ca570
??0StringView@v8_inspector@@QEAA@PEBE_K@Z	1035	0x14042dec0
??0StringView@v8_inspector@@QEAA@PEBG_K@Z	1036	0x14042ded0
??0StringView@v8_inspector@@QEAA@XZ	1037	0x14042dee0
??0StringsStorage@internal@v8@@QEAA@XZ	1038	0x1407462c0
??0StubCache@internal@v8@@QEAA@PEAVIsolate@12@@Z	1039	0x14093fae0
??0SuppressMicrotaskExecutionScope@Isolate@v8@@QEAA@PEAV12@PEAVMicrotaskQueue@2@@Z	1040	0x140b06d60
??0Sweeper@internal@cppgc@@QEAA@AEAVHeapBase@12@@Z	1041	0x140452d00
??0SwissNameDictionary@internal@v8@@IEAA@_K@Z	1042	0x140078b40
??0SwissNameDictionary@internal@v8@@QEAA@XZ	1043	0x1400fba60
??0SwitchBuilder@interpreter@internal@v8@@QEAA@PEAVBytecodeArrayBuilder@123@PEAVBlockCoverageBuilder@123@PEAVSwitchStatement@23@HPEAVBytecodeJumpTable@123@@Z	1044	0x1408f2af0
??0Symbolizer@internal@v8@@QEAA@PEAVCodeMap@12@@Z	1045	0x140078b40
??0SyncStreamingDecoder@wasm@internal@v8@@QEAA@$$QEAV0123@@Z	1046	0x140570530
??0SyncStreamingDecoder@wasm@internal@v8@@QEAA@AEBV0123@@Z	1047	0x140570660
??0SyncStreamingDecoder@wasm@internal@v8@@QEAA@PEAVIsolate@23@AEBVWasmFeatures@123@V?$Handle@VContext@internal@v8@@@23@PEBDV?$shared_ptr@VCompilationResultResolver@wasm@internal@v8@@@std@@@Z	1048	0x140570840
??0Thread@base@v8@@QEAA@AEBVOptions@012@@Z	1049	0x140e5f630
??0ThreadTicks@base@v8@@AEAA@_J@Z	1050	0x140078b40
??0ThreadTicks@base@v8@@QEAA@XZ	1051	0x1400fba60
??0ThrowOnJavascriptExecution@internal@v8@@QEAA@PEAVIsolate@12@@Z	1052	0x140a7d8c0
??0TickSample@internal@v8@@QEAA@XZ	1053	0x140745020
??0Time@base@v8@@AEAA@_J@Z	1054	0x140078b40
??0Time@base@v8@@QEAA@XZ	1055	0x1400fba60
??0TimeDelta@base@v8@@AEAA@_J@Z	1056	0x140078b40
??0TimeDelta@base@v8@@QEAA@XZ	1057	0x1400fba60
??0TimeTicks@base@v8@@AEAA@_J@Z	1058	0x140078b40
??0TimeTicks@base@v8@@QEAA@XZ	1059	0x1400fba60
??0TopLevelLiveRange@compiler@internal@v8@@QEAA@HW4MachineRepresentation@23@@Z	1060	0x140f7e4d0
??0TracedGlobalHandleVisitor@EmbedderHeapTracer@v8@@QEAA@AEBV012@@Z	1061	0x140079ac0
??0TracedGlobalHandleVisitor@EmbedderHeapTracer@v8@@QEAA@XZ	1062	0x140079ac0
??0TracedValue@tracing@v8@@AEAA@XZ	1063	0x1406b6840
??0TransitionsAccessor@internal@v8@@QEAA@PEAVIsolate@12@V?$Handle@VMap@internal@v8@@@

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Notice Letter 2025 03 12 02930920.docs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\Notice Letter 2025 .exe

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\msvcp290.dll

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\nasrallah_x86.dll

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\tier0_s64.dll

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vcruntime210.dll

C:\Users\user\AppData\Local\Temp\655dbbc180803461d79d22d98bd1e49a\vstdlib_s64.dll

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a5t1om3.ed5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a10t0xwu.me5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0g4fsbx.l1o.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xndllza0.f25.psm1

C:\Users\user\SystemRootDoc\Notice Letter 2025 .exe

Windows Analysis Report
Notice Letter 2025 03 12 02930920.docs.exe