k__BackingField<WindowTitle>k__BackingField<MacroName>k__BackingField<GroupName>k__BackingField<Theme>k__BackingField<NextTime>k__BackingField<FileType>k__BackingField<ActionType>k__BackingField<LastActionType>k__BackingField<TriggerType>k__BackingField<SearchAreaSize>k__BackingField<SearchAreaSelectorMaxSize>k__BackingField<MousePositioning>k__BackingField<DoNotShowAdministratorWarning>k__BackingField<IsFirstLaunch>k__BackingField<Stopwatch>k__BackingField<Interval>k__BackingField<DownloadUrl>k__BackingField<DiscordUrl>k__BackingField<IngoreDelayLassThan>k__BackingField<RunAsAdmin>k__BackingField<Version>k__BackingField<AppVersion>k__BackingField<RememberLastWindowLocation>k__BackingField<SearchAreaPosition>k__BackingField<UseCursorPosition>k__BackingField<MainWindowPosition>k__BackingField<MacroEditorWindowPosition>k__BackingField<SettingsWindowPosition>k__BackingField<ImageFoundOption>k__BackingField<ImageNotFoundOption>k__BackingField<Description>k__BackingField<ShowDiscordButton>k__BackingField<Info>k__BackingField<PlayOnOffAudio>k__BackingField<PlayOnOffMacroAudio>k__BackingField<AutoSaveMacro>k__BackingField<KeepActiveMacrosAtTheTop>k__BackingField<WaitFor>k__BackingField<Color>k__BackingField<Error>k__BackingField<DoNotShowOfficialWebsites>k__BackingField<MacroSettings>k__BackingField<Actions>k__BackingField<Pos>k__BackingField<MousePos>k__BackingField<Macros>k__BackingField<KeyModifiers>k__BackingField<RecordKeyModifiers>k__BackingField<EnableKeyModifiers>k__BackingField<ActivationKeyModifiers>k__BackingField<TriggerKeyModifiers>k__BackingField<Parameters>k__BackingField<RecordMouseMovements>k__BackingField<KeyPoints>k__BackingField<IgnoreSelfInputs>k__BackingField<RecordDelays>k__BackingField<RecordKeybordKeys>k__BackingField<RecordMouseKeys>k__BackingField<ControllerTriggerKeys>k__BackingField<ModifierKeys>k__BackingField<InputLimit>k__BackingField<LoopCount>k__BackingField<ScrollAmount>k__BackingField<SleepAmount>k__BackingField<EnableOnStart>k__BackingField<LoadLastMacroOnStart>k__BackingField<EnableControllerSupport>k__BackingField<Text>k__BackingField<NoText>k__BackingField<YesText>k__BackingField<CommentText>k__BackingField<OverlayWindow>k__BackingField<Key>k__BackingField<KeyboardKey>k__BackingField<RecordKey>k__BackingField<EnableKey>k__BackingField<MouseKey>k__BackingField<ActivationKey>k__BackingField<TriggerKey>k__BackingField<SuppressTriggerKey>k__BackingFieldGetFieldFixedElementFieldYieldHoldget_MatchThresholdset_MatchThresholdthresholdhWnddeadbandget_Commandset_CommandSendAppendSDL_GameControllerButtonBindget_LimitPerSecondset_LimitPerSecondlimitPerSecondadd_NewVersionFoundremove_NewVersionFoundget_WhenWindowFoundset_WhenWindowFoundfoundset_Backgroundset_IsBackgroundSDL_GetSurfaceAlphaModSDL_SetSurfaceAlphaModSDL_GetTextureAlphaModSDL_SetTextureAlphaModhModSDL_GetSurfaceColorModSDL_SetSurfaceColorModSDL_GetTextureColorModSDL_SetTextureColorModget_Methodset_Methodget_MouseMoveMethodset_MouseMoveMethodget_TitleMatchMethodset_TitleMatchMethodget_ColorMatchMethodset_ColorMatchMethodget_TriggerMethodset_TriggerMethodEKeyTriggerMethodtriggerMethodget_KeyMethodset_KeyMethodmethodperiodSDL_KeymodKeyboardSDLK_eSDL_CreateRGBSurfaceSDL_SurfaceSDL_FreeSurfaceSDL_LockSurfaceSDL_UnlockSurfaceSDL_CreateTextureFromSurfaceSDL_BlitSurfaceSDL_ConvertSurfaceSDL_UpdateWindowSurfaceSDL_GetWindowSurfacesurfaceIsNullOrWhiteSpaceSDL_GetTouchDeviceget_TransformToDeviceSDL_CloseAudioDeviceSDL_PauseAudioDeviceSDL_LockAudioDeviceSDL_UnlockAudioDeviceSDL_OpenAudioDevicecdevicejdeviceRunOnceget_TriggerOnceset_TriggerOnceget_MatchToleranceset_MatchToleranceget_ColorToleranceset_ColorTolerancetolerance_leaveAllocatedInstanceCreateInstanceGetInstance_defaultInstancesilenceImageSourcePresentationSourceHideget_StridesStridetStrideGetHashCodevkCodescanCodeSDL_BlendModeSDL_GetSurfaceBlendModeSDL_SetSurfaceBlendModeSDL_GetTextureBlendModeSDL_SetTextureBlendModeSDL_GetRenderDrawBlendModeSDL_SetRenderDrawBlendModeblendModeFileModeSDL_GetRelativeMouseModeSDL_SetRelativeMouseModeImageLockModeSDL_DisplayModeSDL_GetDesktopDisplayModeSDL_GetDisplayModeSDL_GetCurrentDisplayModeSDL_GetClosestDisplayModeSDL_GetWindowDisplayModeSDL_SetWindowDisplayModeget_LegacyModeset_LegacyModeget_UseVirtualKeyModeset_UseVirtualKeyModeuseVirtualKeyModeunicodeSDL_ScancodeSDL_GetKeyFromScancodescancodeSDL_Keycodemodelarge_magnitudesmall_magnitudeSDL_freeSaveSettingsShowAfterInstallPageTargetCachedImageFindImagesourceImageCaptureImageFromImageBitmapImageDrawImageSDL_LogMessagemessageget_UseRangeset_UseRangeCompareExchangecookieEndInvokeBeginInvokeSDL_RenderGetScaleSDL_RenderSetScaleICloneableNullableget_Enableset_Enableget_IsEnableset_IsEnable_isEnableEnumerableKeyboardInputsForEnableDisableIDisposableset_IsHitTestVisibleIsWindowVisibleget_HandleRuntimeTypeHandleGetTypeFromHandleToggletoggleRectangleINTERNAL_SDL_RWFromFileBitmapFromFileSDL_GameControllerAddMappingsFromFileget_LastFileset_LastFileSDL_GLprofileIsVolatileget_Titleset_Titleget_WindowTitleset_WindowTitleSDL_GetWindowTitleSDL_SetWindowTitleFindWindowByTitletitleset_WindowStyleget_NamenativeLibNameSDL_HapticNameSDL_GetAudioDeviceNameSDL_GetScancodeNameset_FileNameSDL_JoystickNameSDL_GetScancodeFromNameSDL_GetKeyFromNameget_ActionNameget_MacroNameset_MacroNamemacroNameget_GroupNameset_GroupNameSDL_GameControllerNamecontrollerNameSDL_GetPixelFormatNameSDL_GetKeyNameget_PropertyNamepropertyNamedriver_nameget_Themeset_ThemeSDL_MessageBoxColorSchemecolorSchemeSystem.Net.Mimeget_NextTimeset_NextTimetimevolumeSDL_IntersectRectAndLineAppendLineSDL_RenderDrawLineCombineIAsyncStateMachineSetStateMachinestateMachineMemberwiseCloneget_IsGenericTypeSDL_GameControllerBindTypebindTypeChangeTypeget_FileTypeset_FileTypeAssociateFileTypeget_IsValueTypeGetUnderlyingTypeSecurityProtocolTypeminTypeget_ActionTypeset_ActionTypeget_LastActionTypeset_LastActionTypeConvertToTypeget_TriggerTypeset_TriggerTypeSDL_MessageBoxColorTypeGetTypeSDL_EventTypemaxTypeget_PropertyTypetypeWhereSystem.CoreTGMacro.CorePresentationCoreget_scorepressurePtrToStructureget_Cultureset_CultureresourceCultureCaptureiscapturedgesturemgestureSDL_GL_BindTextureSDL_GL_UnbindTextureSDL_UpdateTextureSDL_CreateTextureSDL_LockTextureSDL_UnlockTextureSDL_DestroyTextureSDL_QueryTexturetextureMacroTriggerBaseApplicationSettingsBaseWindowsBasetBaseFindPressedKeysAndSendReleasephaseSDL_LogVerboseSDL_HapticCloseSDL_JoystickCloseSDL_GameControllerCloseDisposeDrawEllipseTryParseSDL_HapticPauseSDL_HapticUnpauseMoveMouseSDL_HapticOpenFromMouseSDL_JoystickUpdateSDL_GameControllerUpdateCreateControllerConnectionDelegateControllerButtonPressDelegateMulticastDelegateSDL_TextureModulaterefresh_rateSDL_GetModStateSDL_SetModStateSDL_GetKeyboardStateDebuggerBrowsableStateEditorBrowsableStateSDL_GetRelativeMouseStateSDL_GetMouseStateget_RunStateset_RunStateETriggerRunState_runStateParallelLoopStateSDL_EventStateSDL_JoystickEventStateSDL_GameControllerEventStateSDL_GetEventState<>1__statemodstateget_Whiteget_CanWriteSDL_PaletteSDL_AllocPaletteSDL_SetSurfacePaletteSDL_FreePaletteSDL_SetPixelFormatPalettepaletteCompilerGeneratedAttributeGuidAttributeGeneratedCodeAttributeUnverifiableCodeAttributeDebuggerNonUserCodeAttributeDebuggableAttributeDebuggerBrowsableAttributeEditorBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeCallerMemberNameAttributeAsyncStateMachineAttributeUnsafeValueTypeAttributeScriptIgnoreAttributeDebuggerStepThroughAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeDebuggerHiddenAttributeExtensionAttributeAssemblyFileVersionAttributeSecurityPermissionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeFixedBufferAttributeUnmanagedFunctionPointerAttributeFlagsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeSDL_GL_GetAttributeSDL_GL_SetAttributeAssemblyCopyrightAttributeDebuggerDisplayAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeset_UseShellExecuteget_PositionAbsoluteByteget_Valueget_ActionStringValueget_HasValueaxisValuehatValueTryGetValueSetValueIsDefaultValuevalueblueSaveget_IsAliveMarshalManagedToNativeget_PositionRelativeSDL_IsTextInputActiveIsWindowActiveget_IsPrimitiveRemoveget_SearchAreaSizeset_SearchAreaSizeGetNativeDataSizeSDL_GL_GetDrawableSizeSDL_RenderGetLogicalSizeSDL_RenderSetLogicalSizeSDL_GetWindowMinimumSizeSDL_SetWindowMinimumSizeSDL_GetWindowMaximumSizeSDL_SetWindowMaximumSizeSDL_GetRendererOutputSizeSDL_GetWindowSizeSDL_SetWindowSizeget_SearchAreaSelectorMaxSizeset_SearchAreaSelectorMaxSizeSerializeDeserializesizeSizeOfIndexOfSDLK_fleft_coeffright_coeffaudio_bufSDLK_gflagget_PngSystem.ThreadingSystem.Windows.ThreadingpaddingOrderByDescendingEncodingStopRecordingget_IsRecording_isRecordingStartRecordingSystem.Windows.Media.ImagingSystem.Drawing.ImagingCeilingget_IsRunningset_IsRunningisRunningSystem.Runtime.Versioningget_MousePositioningset_MousePositioningget_DoNotShowAdministratorWarningset_DoNotShowAdministratorWarningSDL_GameControllerAddMappingSDL_GameControllerMappingFromBase64StringToBase64Stringbase64StringSDL_JoystickGetGUIDStringSendStringmappingStringpchStringSDL_JoystickGetGUIDFromStringSDL_GameControllerGetButtonFromStringSDL_GameControllerGetAxisFromStringToStringlpStringget_ColorStringGetStringget_LoopCountStringToFriendlyStringSystem.DrawingSDL_HapticNumEffectsPlayingdwNewLongGetWindowLongSetWindowLongSDL_LogorgmsgSDL_LogDebugSDLK_hmin_hmax_hwhichget_IsFirstLaunchset_IsFirstLaunch_stopSearchfullMatchSDL_AddEventWatchSDL_DelEventWatchpatchget_StopwatchSDL_SoftStretchsrc_pitchdst_pitchSolidColorBrushMathfilePathSDL_GetBasePathSDL_GetPrefPathapplicationPathGetFolderPathget_Widthset_Widthget_MinWidthset_MinWidthsWidthtWidthget_MaxWidthset_MaxWidthmax_texture_widthget_Lengthset_MaxJsonLengthGetWindowTextLengthfade_lengthattack_lengthstrengthEndsWithStartsWithdepthtexhSDLK_iUriSDLK_jManagedObjlockObjobjSDLK_kHookCallBackAsyncCallbackHookCallbackSDL_AudioCallbackSDL_TimerCallbackcallbackSDL_HapticOpenFromJoystickSDL_GameControllerGetJoystickjoystick_lockmemblockhhkidHookCSInputKeyboardHookCSInputMouseHookControllerHookMouseMovementsHookKeyboardInputsHookMouseInputsHookPresentationFrameworkget_TaskAmaskBmaskGmaskRmaskhat_maskSDLK_lAllocHGlobalFreeHGlobalSDL_LogCriticalMarshalDecimalFromVisualamgKeyCodeToVirtualget_Intervalset_IntervalSDL_GL_GetSwapIntervalSDL_GL_SetSwapIntervalintervalKeyboardDataDelMouseDataDelInfoItemModelTestVersionModelVersionInfoModelversionInfoModelMacroModelMacroSettingsModelSystem.Collections.ObjectModelTGMProjectModelSystem.ComponentModelwheelParallelxrelyrelfade_levelattack_levelBytesPerPixelBitsPerPixelGetPixelpixelSDL_HapticStopAllConvertAllSDL_JoystickGetBalljballgdi32.dllshell32.dlluser32.dllSDL2.dllTGMacro.Core.dllToHtmlset_SecurityProtocolSDL_boolControlget_DownloadUrlset_DownloadUrlget_DiscordUrlset_DiscordUrlGuidCheckUrlVersionCheckUrlVisitUrlCtrlurlSDLK_mFileStreamMemoryStreamstreamlParamwParamparamSDL_RWFromMemmemget_ItemSDL_InitSubSystemSDL_QuitSubSystemsubsystemTrimRandom_randomSDL_CreateRGBSurfaceFromSDL_CreateWindowFromSDL_HapticCustomcustomSDL_GetPlatformget_IsEnumSDL_MasksToPixelFormatEnumsyswmSDL_KeysymkeysymSDLK_nresourceManget_IngoreDelayLassThanset_IngoreDelayLassThanIgnoreDelaysLessThanIsLittleEndianTimeSpanPenShowColorLocationsOnTheScreenCaptureScreenCopyFromScreenFindImageOnScreenFindImageCenterOnScreenSDL_SetWindowFullscreengreenaudio_lenSDL_HapticOpenSDL_JoystickOpenSDL_GameControllerOpenlpfnSDL_HapticSetGaingainget_RunAsAdminset_RunAsAdminJoinwinpause_onget_IconSDL_SetWindowIconiconINTERNAL_SysWMDriverUnionSDL_GetRevisionfileExtensionextensionget_Versionset_Versionget_AppVersionset_AppVersionSDL_GetVersioncurrentVersionIsTestVersionSDL_versionApplicationget_RememberLastWindowLocationset_RememberLastWindowLocationlocationCopyPixelOperationDispatcherOperationSystem.ConfigurationSystem.GlobalizationSystem.Web.Script.SerializationTGProjecActionpassedActionFindImageActionMouseMoveActionIMacroActionAMCToMacroActionAmcToMacroActionActionGroupActionWaitForColorActionWaitActionCommentActionTextActionFindWindowActionKeyboardKeyActionMouseKeyActionWaitForKeyActionSecurityActionSDL_eventactionSystem.ReflectionMatchCollectionGroupCollectionSDL_HapticDirectiondirectionSDL_HasIntersectionSDL_LogOutputFunctionSDL_LogGetOutputFunctionSDL_LogSetOutputFunctionSDL_HapticConditionconditionGetGenericTypeDefinitionget_SearchAreaPositionset_SearchAreaPositionGetMousePositionget_UseCursorPositionset_UseCursorPositionget_MainWindowPositionset_MainWindowPositionget_MacroEditorWindowPositionset_MacroEditorWindowPositionget_SettingsWindowPositionset_SettingsWindowPositionSDL_GetWindowPositionSDL_SetWindowPositionCallingConventionmotionget_ImageFoundOptionset_ImageFoundOptionget_ImageNotFoundOptionset_ImageNotFoundOptionInvalidOperationExceptionSetExceptionArgumentExceptionget_Descriptionset_DescriptionextenstionDescriptionPrettifyJsonStringComparisonjsonget_ShowDiscordButtonset_ShowDiscordButtonMouseButtonSDL_GameControllerButtonSDL_GameControllerGetBindForButtonSDL_GameControllerGetStringForButtonSDL_JoystickGetButtonSDL_GameControllerGetButtoncbuttonjbuttonSDL_LogWarnRunDownSDL_IsScreenKeyboardShownMoveToSDLK_oSDL_GetWindowWMInfoget_Infoset_InfodwExtraInfoFieldInfoCultureInfoSDL_LogInfoget_VersionInfoset_VersionInfoversionInfoMemberInfoSDL_RendererInfoSDL_GetRendererInfoSDL_GetRenderDriverInfoProcessStartInfoPropertyInfoSDL_SysWMinfoINTERNAL_x11_wminfoINTERNAL_cocoa_wminfoINTERNAL_directfb_wminfoINTERNAL_windows_wminfoINTERNAL_uikit_wminfoSDL_CloseAudioSDL_PauseAudioget_PlayOnOffAudioset_PlayOnOffAudioSDL_LockAudioSDL_UnlockAudioSDL_OpenAudioget_PlayOnOffMacroAudioset_PlayOnOffMacroAudioSDL_MixAudioget_AutoSaveMacroset_AutoSaveMacromacroZeroUpSDLK_pCachedBitmapOriginalBitmapBase64ToBitmapbitmapClassicSleepset_ToolTipZipSkipSDL_RendererFlipclipflipget_kp_screenBmpSDL_CalculateGammaRampSDL_GetWindowGammaRampSDL_SetWindowGammaRampSDL_HapticRamprampGetTimestamp_lastTimestamptimestampbmpdwRopget_Topset_Topget_KeepActiveMacrosAtTheTopset_KeepActiveMacrosAtTheTopBringWindowToTopWorkLoopdropSystem.Windows.InteropSDL_HapticRumbleStopstopappbppSystem.Net.HttpActionGroupSDLK_qfreqSystem.LinqSDLK_r<score>j__TPar<kp>j__TParset_ShowInTaskbarSDL_RenderClearCharappVerSDL_GetRevisionNumberIFormatProviderAsyncTaskMethodBuilderStringBuilder<>t__builderSpecialFolderOnRenderBinderMacroRecorder<deadband>e__FixedBuffer<left_coeff>e__FixedBuffer<right_coeff>e__FixedBuffer<center>e__FixedBuffer<dir>e__FixedBuffer<texture_formats>e__FixedBuffer<left_sat>e__FixedBuffer<right_sat>e__FixedBuffer<text>e__FixedBufferget_ResourceManagerServicePointManagerKeyboardTriggerMouseTriggerget_MacroTriggerset_MacroTriggermacroTriggerControllerTriggerColorTriggerTestTriggerEmptyTriggerSDL_FingerSDL_GetTouchFingertfingerget_DispatcherICustomMarshalerLPUtf8StrMarshalerEnableStatusChangedEventHandlerPropertyChangedEventHandlerNewVersionFoundEventHandlerTriggerRunStatusEventHandlerTriggerBusyStatusEventHandlerSystem.CodeDom.CompilerTGMacro.Core.Helpers.ControllerSDL_IsGameControllergamecontrollerSDL_AddTimerSDL_RemoveTimerInputListenerset_OwnerImageHelperActionHelperWindowInteropHelperWindowHelperSDL_CreateWindowAndRendererSDL_CreateSoftwareRendererSDL_CreateRendererSDL_GetRendererSDL_DestroyRendererrendererCurrentUseruserConfiguredTaskAwaiterGetAwaiterInputLimiterlimiterSDL_EventFilterSDL_GetEventFilterSDL_SetEventFilterfilterEnterSDL_HapticSetAutocenterautocenterSDL_GetPerformanceCounterJsonNullDefaultValueHidingConverterBitConverterJavaScriptConverterSDL_EnableScreenSaverSDL_DisableScreenSaverSDL_GetVideoDriverSDL_GetCurrentVideoDriverSDL_GetAudioDriverSDL_GetCurrentAudioDriverGetTextFromServerToLowerJavaScriptSerializerserializerdirget_WaitForset_WaitFormajorSDL_Colorget_Colorset_ColorCircleColorWatchColorWaitForColorSDL_GetRenderDrawColorSDL_SetRenderDrawColorSDL_MessageBoxColorfirstcolorminorget_Errorset_ErrorSDL_LogErrorSDL_ClearErrorSDL_GetErrorSDL_SetErrorerrorSDL_FreeCursorSDL_CreateCursorSDL_SystemCursorSDL_CreateSystemCursorSDL_CreateColorCursorSDL_GetCursorSDL_SetCursorSDL_ShowCursorcursorColorTranslatorIEnumeratorGetEnumeratorActivator.ctor.cctorMonitorStructureToPtrIntPtrSDL_GLattrDefaultTickMsSDLK_sAbsGraphics_graphicsSDL_NumHapticsSystem.DiagnosticsplayComandsget_TotalMillisecondsSDL_GetDisplayBoundsNativeMethodsEColorTriggerMethodsEKeyPressMethodsSDL_GetNumTouchDevicesSDL_GetNumAudioDevicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesTGMacro.Core.Properties.Resources.resourcesDebuggingModesSDL_GetNumDisplayModesallowed_changesColorMatchesColorNotMatchesBrushesUtilitiesSDL_LogResetPrioritiesTGMacro.Core.PropertiesGetPropertiessamplesMediaTypeNamesSDL_RenderDrawLinesget_SupportedTypesEActionTypesEMacroActionTypesETriggerTypesCheckForUpdatesget_DoNotShowOfficialWebsitesset_DoNotShowOfficialWebsitesGetCustomAttributesSDL_GL_ResetAttributesGetBytesbytesSDL_HapticNumAxesSDL_JoystickNumAxesget_FlagsBindingFlagsSDL_MessageBoxButtonFlagsSDL_RendererFlagsuFlagsSDL_WindowFlagsSDL_GetWindowFlagsSDL_MessageBoxFlagsKeyFlagswindow_flagsget_GetKeyStringsgetKeyStringsLoadSettingsUpdateSettingsSaveSettingsget_MacroSettingsset_MacroSettingsAppSettingssetDefaultSettingsPropertyChangedEventArgs<>4__thisSDL_GameControllerAxisSDL_GameControllerGetBindForAxisSDL_GameControllerGetStringForAxisSDL_JoystickGetAxisSDL_GameControllerGetAxiscaxisjaxisSDL_GetTicksclicksSDL_NumJoysticksSDL_PixelFormatEnumToMasksSystem.Threading.TasksSDL_RectEqualsTGMacro.Core.Core.ModelsTGMacro.Core.ModelschannelsSDL_RenderReadPixelsSDL_QueryTexturePixelsSDL_ConvertPixelspixelsSDL_JoystickNumBallsSystem.Windows.ControlsTGMacro.Core.EnumsTGMacro.CSInputs.EnumsContainsSystem.Web.ExtensionsEnumExtensionsSystem.Text.RegularExpressionsSystem.Security.PermissionsRefreshAssociationsiterationsget_Actionsset_ActionsGetInvalidActionsClipboardActionsallActionsApplyAutoDelayToActionsTGMacro.Core.Core.MacroActionsTGMacro.Core.MacroActionsmacroActionsactionsSystem.CollectionsStringSplitOptionsRegexOptionsget_PressedButtonspressedButtonsSDL_JoystickNumButtonsnumbuttonsnXPosnYPosget_Posset_Posget_MousePosset_MousePosGetCursorPosposget_Macrosset_Macrosget_Groupsget_CharsTGMacro.Core.MacroTriggersTGProjectTriggersSDL_GetNumTouchFingersnumFingersDownModifiersUpModifiersget_KeyModifiersset_KeyModifiersget_RecordKeyModifiersset_RecordKeyModifiersget_EnableKeyModifiersset_EnableKeyModifiersget_ActivationKeyModifiersset_ActivationKeyModifiersget_TriggerKeyModifiersset_TriggerKeyModifiersmodifierscontrollersTGMacro.Core.Core.HelpersTGMacro.Core.Helpersget_Parametersset_ParametersSystemParametersTGMacro.Core.ConvertersSDL_GetNumVideoDriversSDL_GetNumAudioDriversSDL_GetNumRenderDriversSDL_SetPaletteColorsncolorsFileAccessSDL_TextureAccessaccessProcessSDL_GetWindowBrightnessSDL_SetWindowBrightnessbrightnessadd_ControllerButtonPressremove_ControllerButtonPressSDL_GL_GetProcAddressaddressAlossBlossGlossRlossSDL_JoystickNumHatsnum_texture_formatsTGMacro.Core.AbstractsSDL_UpdateWindowSurfaceRectsSDL_FillRectsSDL_RenderFillRectsSDL_RenderDrawRectsSDL_HapticNumEffectsnumrectsTGMacro.CSInputs.StructsLockBitsUnlockBitsbitsadd_MouseMovementsremove_MouseMovementsget_RecordMouseMovementsset_RecordMouseMovementsset_ArgumentsSDL_FlushEventsUnsubscribeAllEventsSDL_PeepEventsSDL_PumpEventsSDL_FilterEventsSDL_RegisterEventsSDL_HasEventsnumeventsSDL_ClearHintsSDL_EnclosePointsSDL_RenderDrawPointsget_KeyPointsset_KeyPointsComputeKeyPointspointsExistsTGMacro.CSInputsadd_KeyboardInputsremove_KeyboardInputsInputListener_KeyboardInputsadd_MouseInputsremove_MouseInputsInputListener_MouseInputsget_IgnoreSelfInputsset_IgnoreSelfInputsSDL_GetKeyboardFocusSDL_GetMouseFocusSDL_GetAudioDeviceStatusSDL_AudioStatusSDL_GetAudioStatusSDL_HapticGetEffectStatusTGMacro.Core.WindowsSystem.WindowsEnumWindowsLeftWindowsRightWindowsget_RecordDelaysset_RecordDelaysSDL_GetNumVideoDisplaysDisposeOverlaysShowHideOverlayColorOverlaysSuppressedKeysRecordKeyboardKeysget_RecordKeybordKeysset_RecordKeybordKeysget_RecordMouseKeysset_RecordMouseKeysget_ControllerTriggerKeysset_ControllerTriggerKeysGetEModifierKeysget_ModifierKeysset_ModifierKeysnumkeysGetColorAtGetHexColorAtElementAtSDLK_tSDL_JoystickGetHatConcatrepeatINTERNAL_GameControllerButtonBind_hatjhatSDL_AllocFormatSDL_ConvertSurfaceFormatSDL_FreeFormatImageFormatSDL_PixelFormatSDL_GetWindowPixelFormatSDL_MixAudioFormatsrc_formatpixel_formatdst_formatleft_satright_satSDL_RectSDL_FillRectSDL_RenderFillRectSDL_UnionRectSDL_GetClipRectSDL_RenderGetClipRectSDL_SetClipRectSDL_RenderSetClipRectSDL_IntersectRectSDL_SetTextInputRectSDL_RenderDrawRectSDL_HapticEffectSDL_HapticUpdateEffectSDL_HapticRunEffectSDL_HapticStopEffectSDL_HapticNewEffectSDL_HapticDestroyEffecteffectDispatcherObjectobjectSelectclip_rectsrcrectdstrectSystem.NetMacroTriggerSetget_CompositionTargetSDL_GetRenderTargetSDL_SetRenderTargettargetoffsetget_Leftset_LeftLeftShiftRightShiftAshiftBshiftGshiftRshiftSDL_HapticLeftRightget_Heightset_Heightget_PrimaryScreenHeightget_MinHeightset_MinHeighttHeightget_MaxHeightset_MaxHeightmax_texture_heightleftrightSpinWaitConfigureAwaitop_ExplicitedituikitSDL_UpperBlitSDL_LowerBlitSplitget_InputLimitset_InputLimitSDL_InitSDL_HapticRumbleInitSDL_VideoInitSDL_AudioInitSDL_WasInitSDL_QuitSDL_VideoQuitSDL_AudioQuitquitExitAltBitBltget_DefaultGetValueOrDefaultget_ResultIAsyncResultParallelLoopResultGetResultSetResultresultfmtSDL_HapticConstantconstantHttpClientUIElementFrameworkElementCommentEnvironmentget_Transparentget_CurrentSDL_GL_MakeCurrentSDL_RenderPresentSDL_SysWMEventSDL_EventSDL_GenericEventSDL_KeyboardEventInjectKeyboardEventSDL_ControllerDeviceEventSDL_JoyDeviceEventSDL_MultiGestureEventSDL_DollarGestureEventSDL_TextEditingEventSDL_PushEventSDL_FlushEventSDL_MouseWheelEventSDL_JoyBallEventSDL_PollEventSDL_MouseMotionEventSDL_MouseButtonEventSDL_ControllerButtonEventSDL_JoyButtonEventSDL_DropEventSDL_TouchFingerEventSDL_UserEventSDL_HasEventSDL_ControllerAxisEventSDL_JoyAxisEventSDL_JoyHatEventSDL_WaitEventSDL_QuitEventSDL_TextInputEventSDL_WindowEventwindowEvent_eventsdleventSDL_GetHintSDL_SetHintWin32PointSDL_PointSDL_RenderDrawPointKeyPointSDL_GetCPUCountget_Countget_LoopCountset_LoopCountnMaxCountrefcountget_ScrollAmountset_ScrollAmountget_SleepAmountset_SleepAmountExceptThreadStartget_EnableOnStartset_EnableOnStartget_LoadLastMacroOnStartset_LoadLastMacroOnStartstartConvertAbortSDL_HasScreenKeyboardSupportget_EnableControllerSupportset_EnableControllerSupportSDL_RenderGetViewportSDL_RenderSetViewportdstclosestdDistGetInvocationListToListset_TopmostFirstSDL_WaitEventTimeouttimeoutlayoutAmcInputTGMacro.CSInputs.ReadInputTGMacro.CSInputs.SendInputSDL_StopTextInputSDL_StartTextInputMoveNextSystem.Textget_Textset_TextSDL_HasClipboardTextSDL_GetClipboardTextSDL_SetClipboardTextReadAllTextWriteAllTextget_NoTextset_NoTextget_YesTextset_YesTextget_CommentTextset_CommentTextGetWindowTextnextSDL_GL_CreateContextSDL_GL_DeleteContextDrawingContextSetProcessDpiAwarenessContextSDL_GL_GetCurrentContextSDL_GLcontextSDLK_uSDLK_vdevSDLK_wmin_wmax_wStartNewFindWindowGetForegroundWindowSetForegroundWindowSDL_HideWindowSDL_RestoreWindowSDL_RaiseWindowSDL_CreateWindowSDL_MinimizeWindowSDL_MaximizeWindowSDL_WarpMouseInWindowSDL_GL_SwapWindowSDL_GL_GetCurrentWindowSDL_ShowWindowget_OverlayWindowset_OverlayWindowSDL_DestroyWindowwindownCmdShowfreerwtexwUnhookWindowsHookExSetWindowsHookExCallNextHookExSDL_RenderCopyExSDLK_xhot_xMaxmaxdxColorToHexSDL_HapticIndexmodeIndexnIndexSDL_JoystickNameForIndexSDL_GameControllerNameForIndexSDL_GetWindowDisplayIndexdisplayIndexfirstKeyIndexdevice_indexjoystick_indexRegexMatrixSDL_ShowSimpleMessageBoxINTERNAL_SDL_ShowMessageBoxSDLK_yhot_ySDL_HapticRumblePlaySDL_DelayuseAutoDelayautoDelaydelaydisplayToArraymimicLegacyset_AllowsTransparencySDL_GetPerformanceFrequencySDL_SetMainReadyget_Keyset_KeyCreateSubKeyget_KeyboardKeyset_KeyboardKeyget_RecordKeyset_RecordKeyget_EnableKeyset_EnableKeyget_MouseKeyset_MouseKeySDL_GetScancodeFromKeyget_ActivationKeyset_ActivationKeyfindNextActionKeyget_TriggerKeyset_TriggerKeyget_SuppressTriggerKeyset_SuppressTriggerKeytriggerKeyModifierKeymodifierKeyWaitForKeySDL_GetColorKeySDL_SetColorKeyContainsKeyRegistryKeykeySHChangeNotifyget_AssemblyAsReadOnlyAnySDL_RenderCopydictionarySDL_HapticQuerycategoryMacroDirectoryRegistryget_IsBusyset_IsBusyisBusyget_Capacityop_Equalityop_InequalityGetColorSimilaritySDL_LogPrioritySDL_SetHintWithPrioritySDL_LogSetAllPrioritySDL_LogGetPrioritySDL_LogSetPrioritySDL_HintPriorityprioritySystem.SecuritySDL_RectEmptySDLK_z7{{ kp = {0} score = {1} }}\TGMacro;https://discord.gg/gJ5ZNt4AAW'#{0:X2}{1:X2}{2:X2}settings.jsonhttps://trksyln.net/projects/tgm-gaming-macro-tgmacro/installedMhttps://gettgmacro.com/validguids.jsonI1a8b7942-65f0-4415-b381-17b9f3f59f05#Software\Classes\%shell\open\command" " "%1"CTGMacro.Core.Properties.ResourcesMacroNameIsEnable IconIsRunning IsBusyepack://application:,,,/Images/actions/color_48.pngkpack://application:,,,/Images/actions/keyboard_48.pngepack://application:,,,/Images/actions/mouse_48.pngopack://application:,,,/Images/actions/controller_48.pngopack://application:,,,/Images/actions/color_gray_48.pngupack://application:,,,/Images/actions/keyboard_gray_48.pngopack://application:,,,/Images/actions/mouse_gray_48.pngypack://application:,,,/Images/actions/controller_gray_48.pngMacroTriggerGetKeyStrings iconOnce, Color at +As long as, Color at cursor pos. ({0}, {1})matches with !NOT matches with{0},{1},{2} + Once, When ButtonpressedAs long as!pressed and hold+Starts and stops whenOnce, Whenreleased grayETGM Gaming Macro Project (TGMacro){0};{1};{2}{0};{1};OK NoneGroup", Loop: , Actions: My groupCmt/Type your comment here!KeyboardMouse ( Rel. Abs. X: , Y: ) Move FImg1Search image at {0}, {1} Text)Type your text here!WaitC#matches color at /doesn t match color at cursor Wait Milliseconds-{0} - {1} MillisecondsWaitKWait until () )TGMacro color target{Error converting value '{0}' to property '{1}' of type '{2}'. FWinFind window ()LeaveAllocated9ManagedObj must be a string.ManagedObjrbwb-<Syntax>(.*?)</Syntax>mover movetodelay downupkeywheelupwheeldown leftright middleleftdown leftup openyC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeIhttps://gettgmacro.com/manifest.json̏/pC2;5 E ] q q mq - A q E Amm E %%0 40 1 9 9 == EA A IME lm$mm$m$$$$$$$$$$m$m$$#EEE $$ $QE $mE $m$ $$$ LX\TLX\T) Y$a i q( mE"mLX\-Tm hEE h E%%% % 5m<% \XTLm@ E =h= hm@6tpl|hdxm@ Eh h hEEEEE8I- d A - -A QQ - - Ya Q e ]aQ e m i m yyqqq yu qqqq qqq q }yyu} y q Eq QQ@ QQ A D'mmlplpllpp qLLL LHHH Hmh } E &<d "|h|hhEh Qxq L )mm % EE?&m } 0mdlpdEE &lp -A EE -) 0 D m 99 9 h 1 19 909 z\V418V6N5?_ :H1a8b7942-65f0-4415-b381-17b9f3f59f05Lhttps://gettgmacro.com/validguids.jsonHhttps://gettgmacro.com/manifest.json -@LeaveAllocatedSDL2.dll 128SDL_FRAMEBUFFER_ACCELERATION"SDL_RENDER_DRIVER2SDL_RENDER_OPENGL_SHADERS<SDL_RENDER_DIRECT3D_THREADSAFE SDL_RENDER_VSYNC SDL_VIDEO_X11_XVIDMODE SDL_VIDEO_X11_XINERAMA(SDL_VIDEO_X11_XRANDR"SDL_GRAB_KEYBOARD@SDL_VIDEO_MINIMIZE_ON_FOCUS_LOSS6SDL_IOS_IDLE_TIMER_DISABLED(SDL_IOS_ORIENTATIONS$SDL_XINPUT_ENABLED0SDL_GAMECONTROLLERCONFIGHSDL_JOYSTICK_ALLOW_BACKGROUND_EVENTS"SDL_ALLOW_TOPMOST(SDL_TIMER_RESOLUTION0SDL_RENDER_SCALE_QUALITY4SDL_VIDEO_HIGHDPI_DISABLEDDSDL_CTRL_CLICK_EMULATE_RIGHT_CLICK2SDL_VIDEO_WIN_D3DCOMPILER8SDL_MOUSE_RELATIVE_MODE_WARPFSDL_VIDEO_WINDOW_SHARE_PIXEL_FORMAT6SDL_VIDEO_ALLOW_SCREENSAVER:SDL_ACCELEROMETER_AS_JOYSTICK>SDL_VIDEO_MAC_FULLSCREEN_SPACES /@ @{ [\@ PQRSTU !"#$%&'()*+ -./0123456789:;<=>?ABCDEFGHIJKLMNOPQRSTUVWXYZ]^_`abcdefghijklmnopqrstuvwxyz{|}~ 9@:@;@<@=@>@?@@@A@B@C@D@E@F@G@H@I@J@K@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @@@ @@@@@@@@@@@@@@@?.System.Security.Permissions.SecurityPermissionAttribute mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089TSkipVerification< 7TGMacro.Core.Helpers.Controller.SDL2.LPUtf8StrMarshalerJ 7TGMacro.Core.Helpers.Controller.SDL2.LPUtf8StrMarshalerLeaveAllocated******imDq4uy $)%m<@ Hh I--(UA}LHmh }i$$$ h,9 9, =h04 h< QPTX`dtpl QxT048 $(,DHLPX`dhltx|m (DDqq $ $ ) % m< m< @ @ H H h h h hA - - A uqu uu q Eq Q( Q ( LH h P PTXXXX \\ | ` PPP P P P PPP P P <DPP <<@P@ LHPPHLHHLL P X Pdd pddhh phh P EE D D $$ $ h h h hA X X m m ((Dq( ($(()(((((((m<((@((( (H(((((h(-(((((((A (Eq( h((mTWrapNonExceptionThrowsTGMacro.CoreTGM Gaming Macro Coretrksyln.netCopyright © 2024TGMacroCore)$253e82fd-1600-40be-920a-d498216a15341.0.0.0I.NETFramework Version=v4.5TFrameworkDisplayName.NET Framework 4.5*%TGMacro.Core.Utilities+<VisitUrl>d__72-TGMacro.Core.Utilities+<CheckForUpdates>d__104/TGMacro.Core.Utilities+<GetTextFromServer>d__12WRTGMacro.Core.Models.MacroModel+<>c__DisplayClass26_0+<<MacroRunStateChanged>b__1>dcZSystem.UInt32 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089aXSystem.Byte mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089 (B3) (B4) (B1) (B2) (Sel)(Home)(Menu) (LS) (RS) (L1) (R1) (DUp)(DDown)(DLeft) (DRight) (L2) (R2)bYSystem.Int32 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089cZSystem.UInt16 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089bYSystem.Int16 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089<\{ kp = {kp} score = {score} }TType<Anonymous Type>A3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.14.0.0lSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP\JvRSDS&SNC:\Users\tarik.saylan\source\repos\trksyln\TGUI\TGMacro.Core\obj\x86\Release\TGMacro.Core.pdb _CorDllMainmscoree.dll% 0HX4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0DCommentsTGM Gaming Macro Core8CompanyNametrksyln.netB FileDescriptionTGMacro.Core0FileVersion1.0.0.0BInternalNameTGMacro.Core.dllHLegalCopyrightCopyright 2024@LegalTrademarksTGMacroCoreJOriginalFilenameTGMacro.Core.dll: ProductNameTGMacro.Core4ProductVersion1.0.0.08Assembly Version1.0.0.0?", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELiK!0JFh `gO<g8 H.textH J `.rsrcL@@.relocP@B&hH1x5f~***&( *09~ ,"rp( o s ~+*0~ +*"*0~ +*"( *Vs ( t*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*f(( (*0 ,+ .+ + +[.S\.N%.I'.D&.?(.:-.5..0$.+#.&!.!". . .[.\+,` (-+}#}(0}} ~A}}0}$~2~2~1(2&*0$ +o (X o -*0 }}} ~A}}0 }}} ~A}}0 }#}$}#}$( ( (2&*( ( 12*07~ ( [. R+ ,~ (*F~ (*02( [3 R+ ,(*0<, ( [. R+ ,Zh [. \+, +/ Q. R+, + .+Z }(! ("}(" (!},+ . 3+Z`}~A}}/}$%( ( (2&*0 }(! ("}(" (!},+ }~A} }/}$%( ( (2&*0? ,0(# o$ (% X Z(# o$ (& [++*0? ,0(# o$ (' X Z(# o$ (( [++*0){3 () t|3(+ 3*0){3 (+ t|3(+ 3*0){4 () t|4(+ 3*0){4 (+ t|4(+ 3*0){5 () t|5(+ 3*0){5 (+ t|5(+ 3*0s, }7}8}9(- }8}9s. %o/ %o0 %o1 %o2 % o3 o4 (5 (*s-}6*0 % }( })}'}* % }( })}'}* i ( ( (3&*05{3%-&+'((|6o8*07(6 9( ( ( ( (7 (4 ,8{3,6{%{+3'( {&{{(8 +9{9,{&{{~A(9 +,8_{&{{ _,|&|} +|&|} {8,1{&{{ -{7{&{{o: + ,8{8,4{&{{ -!{7{&{{o: + ,{7{&{{o; {8,2{&{{ 3{7{&{{o: +,{7{&{{o< &{&{{,2|&|{&{{*. + }{3%-&+H {&{{( {&{{ ( |6o8{5-{4,{%{++9D{9,!{&{{"n~A(9 j+,8(= {:~ (> ,}:(! |:(! Y(" |:(" Ys? (({&{{9+s@ %(A {&{{ ,x{&{{0 \+ [(({4%-&+|6o<({4%-&+|6o<{&{{ ,x{&{{0 Q+ R(({4%-&+|6o<({4%-&+|6o<8{&{{(B _,<(B (({4%-&+|6o<{&{{(B _,< (B ( ({4%-&+ |6o<XoC !!:!+W{&{{-{:((D +"",)(}:{5%-&+|6o<(E *r( .s7o#*0( [5.V+.c+[.p8\.z+ .+ .+x( _};+d( _}<+P( _}=+<( _}>+(( _}?+( _}@+*"( *~sF ? oG (H A*BSJBv4.0.30319l#~D,#Stringsp-P#US-#GUID-#BlobW= 37>RH? bSx {6 Gx gx 6x :l -Gs sQUYG=G: GZGSGOGG x G| GG m GO HGGNGAAAi WmWmfWm WmWmWm0m#-m%m'm+m/iA1A3" y3#A;- AA/EB7E7@I7VL7c 7 7A7m7 7 ;m?'_*q.2-6:* >k>A&A`D>:>6Y-G:A&A`D>G&K&A&ATNRV;>H>ADMZh D@D!^b1^ 1fkooms!1w!'v '0''#'-'='I'ND>VVi>V=:V:VV:VZViZ>V!6V6V6V 6V6V|6V6V5 6VH6V6VI 6V6V06V-6V6Vs 6V6V6V 6V6V&6V6V6V6Va6V6V6V6VB6V6V6V6V6V@6V6Vy6V6V6V6V6V6V,6VN6V6VA6V\6Vs6V6V6V6V6V6V6V6V6V6V6V 6V6V6V6V6V46V66V>6V@6VB6VD6VF6VH6VJ6VL6VN6VV6V6V6V6V=6VI6V6V6V/6VX6V6VD6V_6Vv6V6V6V6V6VC 6V6V6VV 6Vz6V 6V6VF6V6V96VT6Vk6V6V6V6V6V6V76V6V6VL6Vg6V~6V6V6V6V6V;6V6V6VP6Vk 6V` 6V 6Vc6V@6V'6V46V6V6V6V6VP6VY6V. 6V6V&6V6VQ 6V/6V6V6V 6V6V`6V6VI6V6V6V&6V\6V6V<6VW6Vn6V6V6V6VX6V6V6V6V6V6V6V6V6V?6V6V6V+6V 6V86V 6V6Vx6VP6VA6V;6V 6V 6V6V6VU6V6VB6V6>V!GVGVGVGVsGVGVGVrGVGVGV'GVGV VF 3iP W %_ f g ` t Y e 1 ` f !!#!+!4!<!E!M!V!^! g!% o!: x!P !P " " #f #P$P4$P t$P%E!h&)&j) '0"8'0#p'6$'6%'p6&(6'P(` <(( B*t)_G+)p-/` O.0U/ q^1 c2 Li4 m4 v7 :0` ?0f ?` ?UAC|G` IKM|Q ;9 'Q'Q'Q'QQ ]0 " 7W W ,FV U""H JU""H J ` ` ` )` 1` 9` A` I` Q` Y` a` i` q` y` ` ` ` ` ` &)` ` 141=` C` IUQ^Y>zY ao #it ^q{q ^ ylyO ` ` ` d 5!Z!bgmO gs x` ` xp` 6!="I"Y"m"%% (,48<@DHLPTX\`dhlptx |!$'*-0369<?BEHKNQTWZ]`cfilorux{~ $(,048<@DHLPTX\`dhlptx| #&),/258;>AD G$J(M,P0S4V8Y<\@_DbHeLhPkTnXq\t`wdzh}lptx| (,048 < @DHLPT\` {!{!....#.+(.3G.;M.C.K^.S.[G.cv.k.s@{Iccc{i{B{{`{{{{{{ {@{A{A`{a{a{{{{{c{`{{{{{{a{a{{< !"/0 KPcu %txx)y5 > #$%&'( _qacL@e@g iPhLG KUUICO00F10F20__StaticArrayInitTypeSize=60N0Numpad0F11F21OEMPA1F1OEM1N1List`1Numpad1LaunchApplication1XButton1ExtraButton1OEM102F12F22User32user32OEMPA2F2OEM2N2Numpad2LaunchApplication2XButton2ExtraButton2F13F23OEMPA3BBE845544E7DADE109E92B8271D4E966C22C84759757B05C359D2654461B54D3F3OEM3N3Numpad3F14F24F4OEM4N4Numpad4F15F5OEM5N5Numpad5F16F6OEM6N6Numpad6F17F7OEM7N7Numpad7F18F8OEM8N8Numpad8F19F9N9Numpad9<Module><PrivateImplementationDetails>ABCDEEREOFGHIJKRI_MOUSE_HWHEELRI_MOUSE_WHEELMOEMATTNOPQRSTUVOEMENLWOEMAXget_Xset_XCalculateAbsoluteCoordinateXLastXget_Yset_YCalculateAbsoluteCoordinateYLastYZvalue__HanjaJunjaOEMCommaKanaKeyboardDataMouseDatamouseDataButtonDatapDataGetRawInputDatadataFujitsu_LoyaFujitsu_RoyaOEMBackTabmscorlibSystem.Collections.GenericWndProcThreadAddInterlockedIsDefinedReservedSynchronized<UseVirtualKeyMode>k__BackingField<PositionAbsolute>k__BackingField<PositionRelative>k__BackingField<Flags>k__BackingField<Key>k__BackingFieldEnduiCommandSendmethodOEMPeriodRawKeyboardMouseWheelBackwardMouseWheelForwardBrowserForwardSpacehDeviceRawInputDeviceNotifyKeyDownsOncenotifyKeyDownsOncedefaultInstanceDivideMakeCodeuCodeget_UseVirtualKeyModeset_UseVirtualKeyModeUsagePageHIDUsageGetCSInputsMessageModeChangeCompareExchangeEndInvokeBeginInvokeMouseMiddleget_HandleRuntimeFieldHandleRuntimeTypeHandleCreateHandleGetTypeFromHandlehandleRectangleset_StyleNonametimeHomeCombineNoneEscapeValueTypeuMapTypeRawInputTypedwTypetypeget_Cultureset_CultureresourceCultureApplicationSettingsBaseMediaPlayPauseRawMouseMulticastDelegateDebuggerBrowsableStateEditorBrowsableStateDeleteCompilerGeneratedAttributeGuidAttributeGeneratedCodeAttributeDebuggerNonUserCodeAttributeDebuggableAttributeDebuggerBrowsableAttributeEditorBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeFlagsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeExecuteget_PositionAbsoluteset_PositionAbsolutevalueget_PositionRelativeset_PositionRelativeRemovepcbSizeInputSizedwSizeSizeOfIgnoreSelfignoreSelfflagSystem.ThreadingSystem.Runtime.VersioningMousePositioningSendStringSystem.Drawingget_MsgchOEMFinishMathget_Widthset_Widthget_LengthGetLengthwVkBrowserBackAsyncCallbackcallbackMediaNextTrackScrollLockNumLockCapsLockMarshalDecimalFinalEqualKeyboardDataDelMouseDataDelCRSelOEMCUSelEXSelCancelSystem.ComponentModelLaunchMailuser32.dllTGMacro.CSInputs.dllLeftControlRightControlOEMWSCtrlget_LParamwParamSystemRandomZoomEnumresourceManwScanVkKeyScanget_PrimaryScreenUnionApplicationExtraInformationSystem.ConfigurationSystem.GlobalizationSystem.Reflectionget_PositionMiddleButtonLeftButtonRightButtonPageDownVolumeDownkeysAreDownKeyDownMoveToGetMessageExtraInfodwExtraInfoCultureInfoOEMAutoPageUpVolumeUpKeyUpSleepICOHelpOEMJumpMediaStopOEMClearICOClearSendCharPrintScrcbSizeHeaderRawInputHeaderget_ResourceManagerSystem.CodeDom.CompilerInputListenerlistenercharacterNumpadEnterCursorSeparator.ctor.cctorIntPtrAbsSystem.Diagnosticsget_BoundsTGMacro.CSInputs.NativeMethodsuiNumDevicesRegisterDevicespRawInputDevicesRegisterRawInputDevicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesTGMacro.CSInputs.Properties.Resources.resourcesDebuggingModesTGMacro.CSInputs.Propertiesget_Flagsset_FlagsdwFlagsKeyFlagsflagsSettingsCreateParamsSystem.Windows.FormsTGMacro.CSInputs.EnumsContainsRawButtonsmousePosLastCursorPosget_CharsRuntimeHelpersTGMacro.CSInputs.Structsadd_MouseMovementsremove_MouseMovementsTGMacro.CSInputsadd_KeyboardInputsremove_KeyboardInputsListener_KeyboardInputsadd_MouseInputsremove_MouseInputsnInputspInputsOEMPlusOEMMinusMediaPreviousLeftWindowsRightWindowsKeyboardKeysMouseKeysModifierKeysSubtractObjectobjectLaunchMediaSelectGetHwndTargetPacketOEMResetMouseLeftMouseWheelLeftLeftShiftRightShiftMouseRightMouseWheelRightget_Heightset_Heightop_ExplicitAltget_DefaultIAsyncResultresultmouseMovementInjectKeyboardEventPointPrintscrollAmountAcceptInsertNonConvertTGMacro.CSInputs.Structs.InputTGMacro.CSInputs.ReadInputTGMacro.CSInputs.SendInputKeyboardInputkeyboardInputMouseInputmouseInputhRawInputNexttextFujitsu_TourokuLeftMenuRightMenuFujitsu_MasshouNativeWindowdxPlayInitializeArrayinputArraydyget_Keyset_KeyMapVirtualKeyModifierKeymodifierKeyProcessKeykeyget_AssemblyMultiplyOEMCopyop_Equalityop_InequalityEmptyKTGMacro.CSInputs.Properties.Resourcesأg/I>0c I aYY ] ,XX,< ,<<<q,<<$ ,<<$u uttt txxx x}` 444#0q qqq ``z\V4?_ : !"#$%&'()*+ -./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]_`abcdefghijklmnopqrstuvwxyz{|}~@[\QR<Y]`X d<8p\$ txL}`Th|(Y]] ` ` X X d d q q``XddX dqhdXqhqhh t x `X H L ,4 0 L L L LY](`(X(d(qTWrapNonExceptionThrows CSInputswindows api input librarytrksyln.netCopyright © 2021)$3b666193-fd40-4a29-849a-8f7f8f03f1971.0.4.0I.NETFramework Version=v4.5TFrameworkDisplayName.NET Framework 4.5A3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.14.0.0lSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP9~tgtIRSDS0ߌGI-}ZC:\Users\tarik.saylan\source\repos\trksyln\TGUI\TGMacro.CSInputs\obj\x86\Release\TGMacro.CSInputs.pdbh4h &h_CorDllMainmscoree.dll% @@0HX4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0LCommentswindows api input library8CompanyNametrksyln.net: FileDescriptionCSInputs0FileVersion1.0.4.0JInternalNameTGMacro.CSInputs.dllHLegalCopyrightCopyright 2021: LegalTrademarksCSInputsROriginalFilenameTGMacro.CSInputs.dll2 ProductNameCSInputs4ProductVersion1.0.4.08Assembly Version1.0.4.0`H8"5e:T57a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp")5f:T41a,GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197360:T428,GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197361:T447,GET /wp-content/uploads/2026/02/dotnetLogo.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197362:T458,GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197363:T451,GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197364:T413,GET /wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197365:T609,GET /wp-content/plugins/gtranslate/flags/svg/en.svg HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h066:T5e2,GET /wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h067:T5e6,GET /wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h068:T5e2,GET /wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h069:T5e2,GET /wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06a:T5e2,GET /wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06b:T5fb,GET /wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06c:T60b,GET /wp-content/uploads/2026/02/cropped-tgm-32x32.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06d:T5e2,GET /wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06e:T5f3,GET /wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06f:T501,POST /g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968 HTTP/2 Host: analytics.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://trksyln.net/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Origin: https://trksyln.net Priority: u=1, i Accept: */* Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty70:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAABERERERERERERERERAAAAOZmZmZmZmZmZmZmZmZEAATmTMzMzMzMRERkRGZmZAAMzMAAHd3d3d3d3d3cZmRADMwB3d3d3d3d3d3d3c5kQAzMAB3d3d3d3d3d3d3cZEAMzAAAHd3d3d3d3d3d3GRADMwAAAAd3d3d3d3d3dxkQAzMAAAAAB3d3d3d3d3cZEAMzAHcAd3d3d3d3d3d3GRADMweIcHiHeHd3iHePdxkQAzMHiHB4h3eHd4h3iHcZEHMzAAAAd3d3d3d3d3d3GRBzMwAHd3d3h4d4d3d4dxkQczMACPh3///3/3iHj3cZEHMzAAj4ePiP9/9/9493GRBzMwB4+H/3j/f/j/+PcDkQczMACPh/94/3/////3A5EHMzd3j4ePiIh//4f/9wORBzM3////f///f/9wj/cDkQczMHiIiHd4iHeHAHiHA5EHM3AAAABwAAAAAAAAAAORBzMwAAAAAHAAAAAAAAADkQczdwAAAAAAAAAAAAAAA5EHM3cAAABwAAAAAAAAAAORBzMwAAAAAAAAAAAAAAADkQczM3AAAAAAAAAAAAAAOZEHczMzMzMzMzMzMzMzMzmRB3MzMzMzMzMzMzMzMzMzMQd3czMzMzMzMzMzMzMzMzcAd3d3d3d3d3d3d3d3d3d3CAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAQ==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790568857019,"unified_at":"2026-09-28T04:14:17.019Z","metadata":{"hashes":{"sha256":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","sha1":"a1025fdc8676ee922f464f67b87c33f1b2cbeb55","md5":"5c3c2231b01a9b769b94962b73d0286d","sha512":"f1fa002ac370a5012df15231a8725efa5255b760722a2e39950d40f52a6e98cd3a221d017dcaa0041a1432f12d7350e267636c62614ff39e786cc24fce72e80e","ssdeep":"12288:rQh0HIc4o0Y3C5tfCsn9N9+I6gPIOVycGmIyrX:a0ocMY3C5tfCsT/G5yrX","ssdeep_chunks":["12288:rQh0HIc","12288:Qh0HIc4","12288:h0HIc4o","12288:0HIc4o0","12288:HIc4o0Y","12288:Ic4o0Y3","12288:c4o0Y3C","12288:4o0Y3C5","12288:o0Y3C5t","12288:0Y3C5tf","12288:Y3C5tfC","12288:3C5tfCs","12288:C5tfCsn","12288:5tfCsn9","12288:tfCsn9N","12288:fCsn9N9","12288:Csn9N9+","12288:sn9N9+I","12288:n9N9+I6","12288:9N9+I6g","12288:N9+I6gP","12288:9+I6gPI","12288:+I6gPIO","12288:I6gPIOV","12288:6gPIOVy","12288:gPIOVyc","12288:PIOVycG","12288:IOVycGm","12288:OVycGmI","12288:VycGmIy","12288:ycGmIyr","12288:cGmIyrX","24576:rQh0HIc","24576:Qh0HIc4","24576:h0HIc4o","24576:0HIc4o0","24576:HIc4o0Y","24576:Ic4o0Y3","24576:c4o0Y3C","24576:4o0Y3C5","24576:o0Y3C5t","24576:0Y3C5tf","24576:Y3C5tfC","24576:3C5tfCs","24576:C5tfCsn","24576:5tfCsn9","24576:tfCsn9N","24576:fCsn9N9","24576:Csn9N9+","24576:sn9N9+I","24576:n9N9+I6","24576:9N9+I6g","24576:N9+I6gP","24576:9+I6gPI","24576:+I6gPIO","24576:I6gPIOV","24576:6gPIOVy","24576:gPIOVyc","24576:PIOVycG","24576:IOVycGm","24576:OVycGmI","24576:VycGmIy","24576:ycGmIyr","24576:cGmIyrX","12288:a0ocMY3","12288:0ocMY3C","12288:ocMY3C5","12288:cMY3C5t","12288:MY3C5tf","12288:C5tfCsT","12288:5tfCsT/","12288:tfCsT/G","12288:fCsT/G5","12288:CsT/G5y","12288:sT/G5yr","12288:T/G5yrX"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"66b08c64b6cb50a8dff36d4e88c7dbdf546b941c"},"file_info":{"file_name":"TGMacro.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":969728,"entropy":6.32,"compile_timestamp":"2074-11-03T01:15:45","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777586413000,"last_seen":1787863823000,"last_multi_scan":1787863823000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":9,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":826836,"raw_size":826880},{"name":".rsrc","virtual_address":"0xcc000","virtual_size":141604,"raw_size":141824},{"name":".reloc","virtual_address":"0xf0000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":239,"suspicious_count":12,"malicious_count":4,"total":255},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"},{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\", Pattern match: \"https://trksyln.net\", Pattern match: \"https://discord.gg/gj5znt4aaw\", Pattern match: \"http://schemas.openxmlformats.org/markup-compatibility/2006\", Pattern match: \"https://gettgmacro.com/getstarted#actioneditor\", Pattern match: \"http://scripts.sil.org/oflthis\", Pattern match: \"https://gettgmacro.com\", Heuristic match: \"gettgmacro.com\", Heuristic match: \"%#developed by trksyln at trksyln.net\", Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\", Pattern match: \"http://www.w3.org/2001/xmlschema-instance\", Heuristic match: \"tj.er\", Heuristic match: \" 2024 gettgmacro.com\", Pattern match: \"https://gettgmacro.com/download/\", Heuristic match: \"trksyln.net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://trksyln.net\", Found HTTPS url \"https://discord.gg\", Found HTTPS url \"https://gettgmacro.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.0.51.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Trigger / Bind Key :\" (Indicator: \" bind \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"/TGMacro;component/usercontrols/actions/ucfindwindow.xaml\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \"usercontrols/actions/ucfindwindow.baml\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \",TGMacro.UI.UserControls.Actions.UCFindWindow\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \",TGMacro.UI.UserControls.Actions.UCFindWindow\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set / Clear\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set Key\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"The WS-Management service does not support the specified compression scheme (%1).\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"The only supported compression type is \"xpress\".\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"Change the value for the compression option and try the request again.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"<Input Sample.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595872'}\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595904'}\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595920'}\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595888'}\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"<HOOK MODULE=\"USER32.DLL\" FUNCTION=\"CallWindowProcW\"/>\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002480.00000000.156111.02A80000.00000004.mdmp\n 00000000-00002480.00000001.158032.02A80000.00000004.mdmp\n 00000000-00002480.00000002.159951.02A80000.00000004.mdmp\n 00000000-00002480.00000003.165464.02A80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin has big resource with name: \"fonts/armata-regular.ttf\" size: \"86256\" and abnormal entropy:\"6.46237837762985\"\n 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin has big resource with name: \"windows/main.baml\" size: \"13328\" and abnormal entropy:\"6.184378004732036\"\n 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin has big resource with name: \"costura.tgmacro.core.dll.compressed\" size: \"70824\" and abnormal entropy:\"7.99239658754341\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000000.156111.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000001.158032.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000002.159951.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000002.159951.073B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000003.165464.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.08810000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.08810000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.08810000.00000004.mdmp\")\n Found string - \\.\\pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG; Source: \"00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp\")\n Found string \"Validation of public key failed.\" (Indicator: \"public key\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 192159; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 239427; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 592315; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 670212; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 670714; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 700496; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 947702; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 248028; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 705358; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 723263; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 249824; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 667219; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002480-00000C2C-1401697571\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp\")\n Found string \"The credential consists of both Password and UserName being supplied together in a pair.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"VPN.UserName=<UserName/InterfaceName>\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002480-00000C2C-1401697571\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002480-00000C2C-1409233861\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002480-00000C2C-1407501523\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002480-00000C2C-1408765407\")\n Found reference to API \"WTSFreeMemoryW\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002480-00000C2C-1408765438\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002480-00000C2C-1400207454\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002480-00000C2C-1400207954\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002480-00000C2C-1449857856\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\"\n Found system information discovery API: \"142599328064,928,115,,GetMonitorInfoW,user32.dll,\"00:41:33.859\",RX=0,PX=0\" in \"00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"<Input Sample.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"<Input Sample.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"<Input Sample.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"<Input Sample.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"<Input Sample.exe\" called \"IsWow64Process\" with parameter \"2480\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"<Input Sample.exe\" called \"GetWindowTextW\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GetWindowTextW\" with parameter \"TGMacro - What's New?\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GetWindowTextW\" with parameter \"TGMacro\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"<Input Sample.exe\" called \"GetActiveWindow\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"<Input Sample.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"<Input Sample.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000000000005c00000000006300000000000000010000007400140000009862a902000000000100000001000000000000002c000000b8b9aa0200000000140000000a000000000000000000000000006f008040aa0214000000000000000000000000000000000000000000000000006e0000000000670000006c006c00 (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name Performance Log Users (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name Performance Monitor Users (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"<Input Sample.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowAction\" (Indicator: \"FindWindowA\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"FindWindowAction\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002480.00000001.158032.02A80000.00000004.mdmp\n 00000000-00002480.00000002.159951.02A80000.00000004.mdmp\n 00000000-00002480.00000003.165464.02A80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"SDL_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineArgs\" (Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"<Input Sample.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"<Input Sample.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\Documents\\TGMacro (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"<Input Sample.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgm\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"<Input Sample.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"trksyln.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"187.124.10.244:443\"\n \"142.251.219.14:443\"\n \"142.250.101.95:443\"\n \"142.251.45.3:443\"\n \"142.251.218.66:443\"\n \"142.251.156.119:443\"\n \"142.251.214.34:443\"\n \"142.251.218.110:443\"\n \"74.125.137.157:443\"\n \"172.217.12.99:443\"\n \"142.251.218.225:443\"\n \"142.251.219.34:443\"\n \"142.251.218.97:443\"\n \"150.171.109.185:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\tarik.saylan\\source\\repos\\trksyln\\TGUI\\TGMacro.UI\\obj\\x86\\Release\\TGMacro.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"The function \"%1\" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found reference to API \"The function: \"%1\" failed unexpectedly. GetLastError=%2!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found reference to API \"GetLastError: %2!d!.%n\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"SDL_ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"FlashWindowEx\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed unmanaged function \"timeBeginPeriod\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed unmanaged function \"timeEndPeriod\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed unmanaged function \"NtQueryTimerResolution\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG\n Found string - \\.\\pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70C40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72250000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74FF0000\n \"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73970000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72EE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 746F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" was detected as \".NET\" and name: \"Library\"\n \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"analytics.google.com\"\n \"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"edgeassetservice.azureedge.net\"\n \"ep1.adtrafficquality.google\"\n \"ep2.adtrafficquality.google\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"fundingchoicesmessages.google.com\"\n \"gettgmacro.com\"\n \"googleads.g.doubleclick.net\"\n \"pagead2.googlesyndication.com\"\n \"stats.g.doubleclick.net\"\n \"tpc.googlesyndication.com\"\n \"trksyln.net\"\n \"www.google.com\"\n \"www.googleapis.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$41","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp\")\n file/memory contains long string(Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"<Input Sample.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpstrksyln.netprojectstgm-gaming-macro-tgmacroinstalled\" has type \"HTML document Unicode text UTF-8 text with very long lines (23010)\"- [targetUID: 00000000-00002480]\n \"settings.json\" has type \"Unicode text UTF-8 (with BOM) text with CRLF line terminators\"- Location: [C:\\settings.json]- [targetUID: 00000000-00002480]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"<Input Sample.exe\" queries basic process information of the \"C:\\8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin.exe\" (UID: 2480)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"<Input Sample.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"<Input Sample.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin.exe\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"<Input Sample.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"<Input Sample.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"<Input Sample.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"<Input Sample.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"<Input Sample.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"<Input Sample.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"<Input Sample.exe\" writes file \"c:\\settings.json\"\n \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin.exe\" writes file \"c:\\settings.json\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002480-00000C2C-1449595271\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"fonts.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"uzwvG\"\n \"sn;mw~\"\n \"h-xNt4\"\n \"utkm4vv\"\n \"ywywu\"\n \"6@wtC\"r\nDv7M9(kh^9\", \"]y^uw\", \"iK2yk7h)+&i)e\", \"LcrZW\n\", \"z(^+^+im\", \"utkm4vv\", \"ywywu\", \"]y^uw\", \"zx\"'%}-zx\"\", \":IM8Nt\", \"m6N6\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"fonts.googleapis.com\" has high entropy\n Contacted domain: \"googleads.g.doubleclick.net\" has high entropy\n Contacted domain: \"analytics.google.com\" has high entropy\n Contacted domain: \"stats.g.doubleclick.net\" has high entropy\n Contacted domain: \"tpc.googlesyndication.com\" has high entropy\n Contacted domain: \"ep1.adtrafficquality.google\" has high entropy\n Contacted domain: \"ep2.adtrafficquality.google\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"pagead2.googlesyndication.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"$4d","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"187.124.10.244\" on port \"443\"\n HTTPS traffic to \"142.251.219.14\" on port \"443\"\n HTTPS traffic to \"142.250.101.95\" on port \"443\"\n HTTPS traffic to \"142.251.45.3\" on port \"443\"\n HTTPS traffic to \"142.251.218.66\" on port \"443\"\n HTTPS traffic to \"142.251.156.119\" on port \"443\"\n HTTPS traffic to \"142.251.214.34\" on port \"443\"\n HTTPS traffic to \"142.251.218.110\" on port \"443\"\n HTTPS traffic to \"74.125.137.157\" on port \"443\"\n HTTPS traffic to \"172.217.12.99\" on port \"443\"\n HTTPS traffic to \"142.251.218.225\" on port \"443\"\n HTTPS traffic to \"142.251.219.34\" on port \"443\"\n HTTPS traffic to \"142.251.218.97\" on port \"443\"\n HTTPS traffic to \"150.171.109.185\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00002480\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$50","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"<add name=\"LocalSqlServer\" connectionString=\"data source=.\\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"<Input Sample.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"<Input Sample.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"<Input Sample.exe\" called \"GetComputerNameW\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"<Input Sample.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"<Input Sample.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"<Input Sample.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"<Input Sample.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"2b7b770\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.073B0000.00000004.mdmp\")\n Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.073B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"SDL_GL_GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 5c3c2231b01a9b769b94962b73d0286d-60002f2-IOHelper~IsAdministrator","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$56","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"<Input Sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"<Input Sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"HARDWAREINFORMATION.MEMORYSIZE\")\n \"<Input Sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"INSTALLEDDISPLAYDRIVERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"<Input Sample.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002480-00000C2C-1451036002\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002480.00000000.156111.00252000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002480.00000000.156111.00252000.00000002.mdmp\n 00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\n Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00002480.00000002.159951.0DD20000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"<Input Sample.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"DCFNYQV8RMLJ36MRDW4SVD6SSHJG6FNY8KJHFAGHSSLRZMQW0VJ0HJLQDCUH7IYVBF7FNJDRNYUIHDQSBDRN27NMNCEZWGLPYC90EDD1OIUPWXWBDEFEQG\"; Value: \"B009000000\")\n \"<Input Sample.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"<Input Sample.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Ellipse\" (Source: 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin, API is part of module: GDI32FULL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"<Input Sample.exe\" at 00000000-00002480-00000C15-1404399021","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"<Input Sample.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"<Input Sample.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2480)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"1F1-9C56-00505691BCD7}\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"System.Windows.FrameworkElement::FindResource(System.Object) at 5c3c2231b01a9b769b94962b73d0286d-60003dc-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 142.251.45.3\"\n \"UDP connection to 142.251.219.14\"\n \"UDP connection to 142.251.218.66\"\n \"UDP connection to 142.251.156.119\"\n \"UDP connection to 142.251.214.34\"\n \"UDP connection to 142.250.101.95\"\n \"UDP connection to 172.217.12.99\"\n \"UDP connection to 142.251.218.225\"\n \"UDP connection to 142.251.218.110\"\n \"UDP connection to 142.251.218.97\"\n \"UDP connection to 142.251.219.34\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Fody\" matched file \"sample.bin\" as \"Detects executables manipulated with Fody\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"PE_EVENTROOT\\CIMV2SCM EVENT PROVIDER\"\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002480.00000001.158032.08810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" claims program is from Sat Nov 3 01:15:45 2074","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"<Input Sample.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgm\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"0000000000\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"0000000000\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF00\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$5d","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"analytics.google.com\" with TTL 300\n \"clients2.googleusercontent.com\" with TTL 49\n \"edge-consumer-static.azureedge.net\" with TTL 152\n \"ep1.adtrafficquality.google\" with TTL 300\n \"ep2.adtrafficquality.google\" with TTL 300\n \"fonts.googleapis.com\" with TTL 300\n \"fonts.gstatic.com\" with TTL 300\n \"fundingchoicesmessages.google.com\" with TTL 300\n \"googleads.g.doubleclick.net\" with TTL 300\n \"pagead2.googlesyndication.com\" with TTL 300\n \"stats.g.doubleclick.net\" with TTL 300\n \"tpc.googlesyndication.com\" with TTL 300\n \"www.google.com\" with TTL 300\n \"www.googleapis.com\" with TTL 300\n \"www.gstatic.com\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003224.00000000.148692.038E0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003224.00000000.148692.038E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 365C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"TGMacro.exe\" called \"EnumWindows\" with parameter \"121827960\" - (UID: 00000000-00003224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"edgeassetservice.azureedge.net\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \",3195,,GetUserNameExW,secur3\" (Indicator: \"GetUserName\"; Source: \"00000000-00003224.00000001.150611.06090000.00000004.mdmp, 00000000-00003224.00000002.152533.06090000.00000004.mdmp, 00000000-00003224.00000003.159964.06090000.00000004.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 18 domains and 18 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"intel_graph":{"map":{"Domain:analytics.google.com":{"type":"Domain","value":"analytics.google.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:edgeassetservice.azureedge.net":{"type":"Domain","value":"edgeassetservice.azureedge.net"},"Domain:ep1.adtrafficquality.google":{"type":"Domain","value":"ep1.adtrafficquality.google"},"Domain:ep2.adtrafficquality.google":{"type":"Domain","value":"ep2.adtrafficquality.google"},"Domain:fonts.googleapis.com":{"type":"Domain","value":"fonts.googleapis.com"},"Domain:fonts.gstatic.com":{"type":"Domain","value":"fonts.gstatic.com"},"Domain:fundingchoicesmessages.google.com":{"type":"Domain","value":"fundingchoicesmessages.google.com"},"Domain:gettgmacro.com":{"type":"Domain","value":"gettgmacro.com"},"Domain:googleads.g.doubleclick.net":{"type":"Domain","value":"googleads.g.doubleclick.net"},"Domain:pagead2.googlesyndication.com":{"type":"Domain","value":"pagead2.googlesyndication.com"},"Domain:stats.g.doubleclick.net":{"type":"Domain","value":"stats.g.doubleclick.net"},"Domain:tpc.googlesyndication.com":{"type":"Domain","value":"tpc.googlesyndication.com"},"Domain:trksyln.net":{"type":"Domain","value":"trksyln.net"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.googleapis.com":{"type":"Domain","value":"www.googleapis.com"},"Domain:www.gstatic.com":{"type":"Domain","value":"www.gstatic.com"},"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078":{"type":"File","value":"221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 12 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa":{"type":"File","value":"339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"image/vnd.microsoft.icon"},"File:35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b":{"type":"File","value":"35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b"},"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7":{"type":"File","value":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec":{"type":"File","value":"c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec"},"File:c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef":{"type":"File","value":"c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9600, cbSize 9654, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"Ip:13.107.226.51":{"type":"Ip","value":"13.107.226.51"},"Ip:142.250.101.95":{"type":"Ip","value":"142.250.101.95"},"Ip:142.251.156.119":{"type":"Ip","value":"142.251.156.119"},"Ip:142.251.210.225":{"type":"Ip","value":"142.251.210.225"},"Ip:142.251.210.234":{"type":"Ip","value":"142.251.210.234"},"Ip:142.251.214.34":{"type":"Ip","value":"142.251.214.34"},"Ip:142.251.218.110":{"type":"Ip","value":"142.251.218.110"},"Ip:142.251.218.170":{"type":"Ip","value":"142.251.218.170"},"Ip:142.251.218.225":{"type":"Ip","value":"142.251.218.225"},"Ip:142.251.218.65":{"type":"Ip","value":"142.251.218.65"},"Ip:142.251.218.66":{"type":"Ip","value":"142.251.218.66"},"Ip:142.251.218.97":{"type":"Ip","value":"142.251.218.97"},"Ip:142.251.219.14":{"type":"Ip","value":"142.251.219.14"},"Ip:142.251.219.34":{"type":"Ip","value":"142.251.219.34"},"Ip:142.251.45.3":{"type":"Ip","value":"142.251.45.3"},"Ip:150.171.109.184":{"type":"Ip","value":"150.171.109.184"},"Ip:150.171.109.185":{"type":"Ip","value":"150.171.109.185"},"Ip:172.217.12.99":{"type":"Ip","value":"172.217.12.99"},"Ip:187.124.10.244":{"type":"Ip","value":"187.124.10.244"},"Ip:2.18.67.149":{"type":"Ip","value":"2.18.67.149"},"Ip:74.125.137.157":{"type":"Ip","value":"74.125.137.157"},"Url:/adblock-check.js":{"type":"Url","value":"/adblock-check.js"},"Url:/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService":{"type":"Url","value":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService"},"Url:/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline":{"type":"Url","value":"/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline"},"Url:/chromewebstore/v1.1/items/verify":{"type":"Url","value":"/chromewebstore/v1.1/items/verify"},"Url:/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx":{"type":"Url","value":"/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx"},"Url:/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap":{"type":"Url","value":"/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap"},"Url:/css?family=Open%20Sans%3A300%2C400%2C500":{"type":"Url","value":"/css?family=Open%20Sans%3A300%2C400%2C500"},"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468":{"type":"Url","value":"/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468"},"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968":{"type":"Url","value":"/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968"},"Url:/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731":{"type":"Url","value":"/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731"},"Url:/googleads.js":{"type":"Url","value":"/googleads.js"},"Url:/i/pub-9495854422341365?ers=1":{"type":"Url","value":"/i/pub-9495854422341365?ers=1"},"Url:/manifest.json":{"type":"Url","value":"/manifest.json"},"Url:/mouse-gesture/config.json":{"type":"Url","value":"/mouse-gesture/config.json"},"Url:/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine":{"type":"Url","value":"/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine"},"Url:/old-site-content/images/adjust-timing.png":{"type":"Url","value":"/old-site-content/images/adjust-timing.png"},"Url:/old-site-content/images/multi-action.png":{"type":"Url","value":"/old-site-content/images/multi-action.png"},"Url:/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html":{"type":"Url","value":"/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html"},"Url:/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js":{"type":"Url","value":"/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js"},"Url:/projects/tgm-gaming-macro-tgmacro/installed":{"type":"Url","value":"/projects/tgm-gaming-macro-tgmacro/installed"},"Url:/projects/tgm-gaming-macro-tgmacro/installed/":{"type":"Url","value":"/projects/tgm-gaming-macro-tgmacro/installed/"},"Url:/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js":{"type":"Url","value":"/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js"},"Url:/sodar/sodar2.js":{"type":"Url","value":"/sodar/sodar2.js"},"Url:/sodar/sodar2/254/runner.html":{"type":"Url","value":"/sodar/sodar2/254/runner.html"},"Url:/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29":{"type":"Url","value":"/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29"},"Url:/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5"},"Url:/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5"},"Url:/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5"},"Url:/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5"},"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js":{"type":"Url","value":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js"},"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js":{"type":"Url","value":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js"},"Url:/wp-content/plugins/gtranslate/flags/svg/en.svg":{"type":"Url","value":"/wp-content/plugins/gtranslate/flags/svg/en.svg"},"Url:/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1":{"type":"Url","value":"/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1"},"Url:/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js"},"Url:/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js"},"Url:/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js"},"Url:/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js"},"Url:/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js"},"Url:/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29"},"Url:/wp-content/uploads/2026/02/cropped-tgm-32x32.png":{"type":"Url","value":"/wp-content/uploads/2026/02/cropped-tgm-32x32.png"},"Url:/wp-content/uploads/2026/02/dotnetLogo.png":{"type":"Url","value":"/wp-content/uploads/2026/02/dotnetLogo.png"},"Url:/wp-content/uploads/2026/02/logo-1.png":{"type":"Url","value":"/wp-content/uploads/2026/02/logo-1.png"},"Url:/wp-content/uploads/2026/02/old-tgmacro-1.png":{"type":"Url","value":"/wp-content/uploads/2026/02/old-tgmacro-1.png"},"Url:/wp-includes/blocks/heading/style.min.css?ver=6.9.1":{"type":"Url","value":"/wp-includes/blocks/heading/style.min.css?ver=6.9.1"},"Url:/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1":{"type":"Url","value":"/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1"},"Url:/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1":{"type":"Url","value":"/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1"},"Url:/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375":{"type":"Url","value":"/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375"},"Url:/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0":{"type":"Url","value":"/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0"}},"chains":[{"id":"1542637439772793420","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1542637451296277363","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"memory","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078"},{"edge_kind":"extracted_from_archive","from_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078","to_key":"File:339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1542637451317248884","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"memory","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078"},{"edge_kind":"extracted","from_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078","to_key":"File:c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"sandbox_network","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:187.124.10.244"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.219.14"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.250.101.95"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.66"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.214.34"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.110"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:74.125.137.157"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:172.217.12.99"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.225"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.219.34"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.97"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:150.171.109.185"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.170"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:150.171.109.184"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.65"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.210.234"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:13.107.226.51"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.210.225"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:2.18.67.149"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:analytics.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:analytics.google.com","to_key":"Ip:142.251.218.110"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.218.65"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.184"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:edgeassetservice.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edgeassetservice.azureedge.net","to_key":"Ip:150.171.109.185"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:ep1.adtrafficquality.google"},{"edge_kind":"resolves_to","from_key":"Domain:ep1.adtrafficquality.google","to_key":"Ip:142.251.219.34"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:ep2.adtrafficquality.google"},{"edge_kind":"resolves_to","from_key":"Domain:ep2.adtrafficquality.google","to_key":"Ip:142.251.218.97"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:fonts.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.googleapis.com","to_key":"Ip:142.250.101.95"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:fonts.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.gstatic.com","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:fundingchoicesmessages.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:fundingchoicesmessages.google.com","to_key":"Ip:142.251.219.14"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:gettgmacro.com"},{"edge_kind":"resolves_to","from_key":"Domain:gettgmacro.com","to_key":"Ip:187.124.10.244"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:googleads.g.doubleclick.net"},{"edge_kind":"resolves_to","from_key":"Domain:googleads.g.doubleclick.net","to_key":"Ip:142.251.214.34"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:pagead2.googlesyndication.com"},{"edge_kind":"resolves_to","from_key":"Domain:pagead2.googlesyndication.com","to_key":"Ip:142.251.218.66"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:stats.g.doubleclick.net"},{"edge_kind":"resolves_to","from_key":"Domain:stats.g.doubleclick.net","to_key":"Ip:74.125.137.157"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:tpc.googlesyndication.com"},{"edge_kind":"resolves_to","from_key":"Domain:tpc.googlesyndication.com","to_key":"Ip:142.251.218.225"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:trksyln.net"},{"edge_kind":"resolves_to","from_key":"Domain:trksyln.net","to_key":"Ip:187.124.10.244"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:www.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.googleapis.com","to_key":"Ip:142.251.218.170"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:www.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.gstatic.com","to_key":"Ip:172.217.12.99"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/projects/tgm-gaming-macro-tgmacro/installed"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/projects/tgm-gaming-macro-tgmacro/installed/"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/adblock-check.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/blocks/heading/style.min.css?ver=6.9.1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/googleads.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/logo-1.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/old-site-content/images/adjust-timing.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/old-site-content/images/multi-action.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/old-tgmacro-1.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/dotnetLogo.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/gtranslate/flags/svg/en.svg"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/cropped-tgm-32x32.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/manifest.json"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/i/pub-9495854422341365?ers=1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/css?family=Open%20Sans%3A300%2C400%2C500"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/sodar/sodar2.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/sodar/sodar2/254/runner.html"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/chromewebstore/v1.1/items/verify"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/mouse-gesture/config.json"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef"},{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa"},{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b"},{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":264,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":21,"dns_resolutions_count":18,"contacted_urls_count":54,"http_requests_count":54},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69fbb24a72ad230fae00494d","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["USA"],"submit_name":"TGMacro.exe","analysis_start_time":"2026-05-06T21:27:40+00:00","indicators_count":{"informative":210,"suspicious":32,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"69f3d0f2728b2527ca09db69","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin","analysis_start_time":"2026-04-30T22:00:19+00:00","indicators_count":{"informative":209,"suspicious":37,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"187.124.10.244","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"142.251.219.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.250.101.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.45.3","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.66","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.156.119","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.214.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"74.125.137.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"172.217.12.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.219.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"150.171.109.185","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"142.251.218.170","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"150.171.109.184","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.210.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"13.107.226.51","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"142.251.210.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"2.18.67.149","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"dns_resolutions":[{"domain":"analytics.google.com","address":"142.251.218.110","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"clients2.googleusercontent.com","address":"142.251.218.65","ttl":49,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.184","ttl":152,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"edgeassetservice.azureedge.net","address":"150.171.109.185","ttl":1446,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"ep1.adtrafficquality.google","address":"142.251.219.34","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"ep2.adtrafficquality.google","address":"142.251.218.97","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"fonts.googleapis.com","address":"142.250.101.95","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"fonts.gstatic.com","address":"142.251.45.3","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns4.google.com","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"fundingchoicesmessages.google.com","address":"142.251.219.14","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"gettgmacro.com","address":"187.124.10.244","ttl":1800,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"googleads.g.doubleclick.net","address":"142.251.214.34","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"pagead2.googlesyndication.com","address":"142.251.218.66","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"stats.g.doubleclick.net","address":"74.125.137.157","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"tpc.googlesyndication.com","address":"142.251.218.225","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"trksyln.net","address":"187.124.10.244","ttl":1800,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"www.google.com","address":"142.251.156.119","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"www.googleapis.com","address":"142.251.218.170","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"www.gstatic.com","address":"172.217.12.99","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"http_requests":[{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/projects/tgm-gaming-macro-tgmacro/installed","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /projects/tgm-gaming-macro-tgmacro/installed HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/projects/tgm-gaming-macro-tgmacro/installed/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /projects/tgm-gaming-macro-tgmacro/installed/ HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/adblock-check.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /adblock-check.js HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/blocks/heading/style.min.css?ver=6.9.1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/blocks/heading/style.min.css?ver=6.9.1 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/blocks/paragraph/style.min.css?ver=6.9.1 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/googleads.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /googleads.js HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/logo-1.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/2026/02/logo-1.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/old-site-content/images/adjust-timing.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /old-site-content/images/adjust-timing.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/old-site-content/images/multi-action.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /old-site-content/images/multi-action.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/old-tgmacro-1.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/2026/02/old-tgmacro-1.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0","method":"GET","response_code":"200","response_phrase":"OK","header":"$5f","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"$60","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/dotnetLogo.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$61","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$62","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$63","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1","method":"GET","response_code":"200","response_phrase":"OK","header":"$64","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/gtranslate/flags/svg/en.svg","method":"GET","response_code":"200","response_phrase":"OK","header":"$65","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$66","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"$67","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$68","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$69","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$6a","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"$6b","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/cropped-tgm-32x32.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$6c","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$6d","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"$6e","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"gettgmacro.com","host_ip":"187.124.10.244:443","url":"/manifest.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /manifest.json HTTP/1.1\nHost: gettgmacro.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"fundingchoicesmessages.google.com","host_ip":"142.251.219.14:443","url":"/i/pub-9495854422341365?ers=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /i/pub-9495854422341365?ers=1 HTTP/2\nHost: fundingchoicesmessages.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"fonts.googleapis.com","host_ip":"142.250.101.95:443","url":"/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap HTTP/2\nHost: fonts.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0\nAccept: text/css,*/*;q=0.1\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: style","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"googleads.g.doubleclick.net","host_ip":"142.251.214.34:443","url":"/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html HTTP/2\nHost: googleads.g.doubleclick.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: navigate\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0, i\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: iframe","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"analytics.google.com","host_ip":"142.251.218.110:443","url":"/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968","method":"POST","response_code":"204","response_phrase":"No Content","header":"$6f","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"stats.g.doubleclick.net","host_ip":"74.125.137.157:443","url":"/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468","method":"POST","response_code":"204","response_phrase":"No Content","header":"POST /g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468 HTTP/2\nHost: stats.g.doubleclick.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://trksyln.net\nPriority: u=4, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"www.gstatic.com","host_ip":"172.217.12.99:443","url":"/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js HTTP/2\nHost: www.gstatic.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://trksyln.net/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://trksyln.net\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"www.gstatic.com","host_ip":"172.217.12.99:443","url":"/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine HTTP/2\nHost: www.gstatic.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://googleads.g.doubleclick.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=1\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"tpc.googlesyndication.com","host_ip":"142.251.218.225:443","url":"/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js HTTP/2\nHost: tpc.googlesyndication.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://googleads.g.doubleclick.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=1\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"fonts.googleapis.com","host_ip":"142.250.101.95:443","url":"/css?family=Open%20Sans%3A300%2C400%2C500","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /css?family=Open%20Sans%3A300%2C400%2C500 HTTP/2\nHost: fonts.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://googleads.g.doubleclick.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0\nAccept: text/css,*/*;q=0.1\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: style","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"ep1.adtrafficquality.google","host_ip":"142.251.219.34:443","url":"/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731 HTTP/2\nHost: ep1.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://trksyln.net\nPriority: u=1, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"ep2.adtrafficquality.google","host_ip":"142.251.218.97:443","url":"/sodar/sodar2.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sodar/sodar2.js HTTP/2\nHost: ep2.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"ep2.adtrafficquality.google","host_ip":"142.251.218.97:443","url":"/sodar/sodar2/254/runner.html","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sodar/sodar2/254/runner.html HTTP/2\nHost: ep2.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: navigate\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0, i\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: iframe","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.185:443","url":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"www.googleapis.com","host_ip":"142.251.218.170:443","url":"/chromewebstore/v1.1/items/verify","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"host":"edge-consumer-static.azureedge.net","host_ip":"150.171.109.184:443","url":"/mouse-gesture/config.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"host":"clients2.googleusercontent.com","host_ip":"142.251.218.65:443","url":"/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2\nHost: clients2.googleusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-Os: Windows\nPriority: u=4, i\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Mesh-Client-Os-Version: 10.0.16299\nSec-Mesh-Client-Webview: 0\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.185:443","url":"/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: Shoreline\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}],"processes":[{"pid":3224,"ppid":0,"name":"TGMacro.exe","command_line":"","sha256":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","normalized_path":"C:\\TGMacro.exe","uid":"00000000-00003224","icon":"$70"},{"pid":6616,"ppid":3224,"name":"msedge.exe","command_line":"--single-argument https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003224","uid":"00000000-00006616"},{"pid":1032,"ppid":6616,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x364,0x7ffd0bd50f18,0x7ffd0bd50f24,0x7ffd0bd50f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001032"},{"pid":8224,"ppid":6616,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1720,i,8814450797294355331,10032610730055576857,262144 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2104 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00008224"},{"pid":7688,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1892,i,1858545153825117560,4758857682127285089,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:11","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00007688"},{"pid":4596,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2116,i,10010501315732231390,13424116732742381265,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2176 /prefetch:13","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00004596"},{"pid":7028,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2330322414 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3004,i,1866185918622136700,16167826962713840860,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4104 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00007028"},{"pid":6744,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2330324055 --skip-read-main-dll --metrics-shmem-handle=3016,i,9181372239902383812,8184046871678290490,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4108 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00006744"},{"pid":2464,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4528,i,5448128650053341777,583670274115145665,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5080 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00002464"},{"pid":1672,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4316,i,13489898913158571514,1661112582528425057,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5060 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001672"},{"pid":5856,"ppid":6616,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=3184,i,11570198115862202173,16813546097020287979,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3120 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00006616","uid":"00000000-00005856"},{"pid":4588,"ppid":6616,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=3184,i,11570198115862202173,16813546097020287979,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3120 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00006616","uid":"00000000-00004588"},{"pid":1764,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5832,i,7570563531408359376,7230335218614014940,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5824 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001764"},{"pid":5028,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5964,i,13765849431814339412,6663383799659685917,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6052 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00005028"},{"pid":8196,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=6116,i,12858693893157619379,16878226534942736318,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3148 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00008196"},{"pid":1544,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2379981853 --skip-read-main-dll --metrics-shmem-handle=5264,i,10659766897055157679,9733051248876415938,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5280 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001544"},{"pid":2032,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2381015324 --skip-read-main-dll --metrics-shmem-handle=4672,i,495153001506454204,4105237748801229120,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4752 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00002032"},{"pid":9124,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4744,i,4054536528081378864,13639518459030648370,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6100 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00009124"},{"pid":1924,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3000,i,6917115033587507155,2548509711721284333,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5576 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001924"},{"pid":796,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5912,i,12114308830555372595,8341353276159015477,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=3000 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00000796"},{"pid":1960,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2428149867 --skip-read-main-dll --metrics-shmem-handle=4024,i,2397287714240374696,7878068228290979246,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6160 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001960"},{"pid":6112,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6532,i,14262709906512488246,18396643434754687892,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6468 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00006112"},{"pid":3864,"ppid":6616,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=6556,i,13478401153754465102,6441270845239808381,262144 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6340 /prefetch:10","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00003864"},{"pid":2760,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6760,i,13097836676760220089,7551580370606422106,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=1248 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00002760"},{"pid":4696,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4964,i,3336943117137054302,15101183212494819842,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6732 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00004696"},{"pid":6596,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2500286716 --skip-read-main-dll --metrics-shmem-handle=5116,i,16752142130302141466,4357991390836699079,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5320 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00006596"}],"all_imported_dlls":["oneauth.dll","mscms.dll","ResourcePolicyClient.dll","version.dll","OneCoreUAPCommonProxyStub.dll","dxgi.dll","onnxruntime.dll","wow64.dll","WindowsCodecs.dll","twinapi.appcore.dll","ncryptprov.dll","BitsProxy.dll","dxilconv.dll","win32u.dll","msvcrt.dll","PresentationFramework.ni.dll","Windows.Shell.ServiceHostBuilder.dll","GdiPlus.dll","ntasn1.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","sapi.dll","msasn1.dll","rmclient.dll","UIAutomationCore.dll","Windows.UI.dll","cldapi.dll","ffmpeg.dll","RTWorkQ.dll","System.Web.dll","dcomp.dll","CoreUIComponents.dll","mdmregistration.dll","dmcmnutils.dll","twinapi.dll","tbs.dll","ucrtbase.dll","imm32.dll","windows.storage.dll","ksuser.dll","d3d11.dll","ntmarta.dll","mswsock.dll","dsreg.dll","slc.dll","winnsi.dll","rometadata.dll","linkinfo.dll","dusmapi.dll","d3dcompiler_47.dll","kernel32.dll","bcryptprimitives.dll","shlwapi.dll","System.Windows.Forms.dll","ncryptsslp.dll","setupapi.dll","dbghelp.dll","D3D12.dll","msvcp140_clr0400.dll","shell32.dll","imagehlp.dll","ncrypt.dll","wwapi.dll","npmproxy.dll","rpcrt4.dll","PresentationCore.ni.dll","wtsapi32.dll","dpapi.dll","WindowsBase.ni.dll","PresentationNative_v0400.dll","SHCore.dll","d3d9.dll","msctfui.dll","rasapi32.dll","mskeyprotect.dll","Windows.Security.Authentication.Web.Core.dll","avrt.dll","wpfgfx_v0400.dll","MpOAV.dll","System.Web.Extensions.dll","nsi.dll","fltLib.dll","gdi32full.dll","System.Core.ni.dll","iertutil.dll","psapi.dll","TextInputFramework.dll","dnsapi.dll","msedge_elf.dll","combase.dll","ntdll.dll","sechost.dll","wininet.dll","DataExchange.dll","oleacc.dll","microsoft_shell_integration.dll","wevtapi.dll","gdi32.dll","vcruntime140_clr0400.dll","cfgmgr32.dll","MpClient.dll","WinTypes.dll","Windows.System.Profile.RetailInfo.dll","oneds.dll","mfplat.dll","apphelp.dll","mscorlib.ni.dll","bcrypt.dll","winsta.dll","UIAutomationTypes.dll","actxprxy.dll","wscapi.dll","user32.dll","ws2_32.dll","dwmapi.dll","comctl32.dll","UIAutomationProvider.dll","FirewallAPI.dll","Windows.Networking.Connectivity.dll","wow64win.dll","wow64cpu.dll","msvcp_win.dll","System.Xml.ni.dll","mscoree.dll","advapi32.dll","System.Drawing.dll","winmmbase.dll","mf.dll","VxSSL32.dll","webengine4.dll","wkscli.dll","schannel.dll","webauthn.dll","msacm32.dll","ole32.dll","gpapi.dll","System.Net.Http.ni.dll","msedge.dll","libEGL.dll","crypt32.dll","propsys.dll","devobj.dll","oleaut32.dll","mscoreei.dll","sppc.dll","Windows.Security.Authentication.OnlineId.dll","aepic.dll","wlanapi.dll","KernelBase.dll","powrprof.dll","wintrust.dll","LC696OlH.dll","d3d10warp.dll","winhttp.dll","FWPUCLNT.DLL","PCPKsp.dll","ucrtbase_clr0400.dll","uxtheme.dll","profapi.dll","wldp.dll","secur32.dll","MMDevAPI.dll","fwbase.dll","netprofm.dll","msctf.dll","edputil.dll","mlang.dll","nlaapi.dll","well_known_domains.dll","msdmo.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","telclient.dll","sspicli.dll","cryptsp.dll","clr.dll","amsi.dll","urlmon.dll","dhcpcsvc.dll","rasman.dll","rtutils.dll","cryptbase.dll","PresentationFramework.Aero2.ni.dll","netutils.dll","winmm.dll","CoreMessaging.dll","PresentationFramework-SystemXml.dll","rasadhlp.dll","KBDUS.DLL","kernel.appcore.dll","rsaenh.dll","clbcatq.dll","sxs.dll","atlthunk.dll","netapi32.dll","slwga.dll","domain_actions.dll","System.ni.dll","System.Xaml.ni.dll","directmanipulation.dll","vcruntime140.dll","libGLESv2.dll","vk_swiftshader.dll","clrjit.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","msvcp110_win.dll","Windows.UI.Immersive.dll","DWrite.dll","System.Configuration.ni.dll","userenv.dll","Accessibility.dll","directxdatabasehelper.dll","TenantRestrictionsPlugin.dll","TextShaping.dll","ExecModelClient.dll","AssignedAccessRuntime.dll","wow64con.dll","umpdc.dll","OneCoreCommonProxyStub.dll","Windows.StateRepositoryClient.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","omadmapi.dll","CorePrivacySettingsStore.dll","usermgrcli.dll","Windows.Internal.Shell.Broker.dll","CryptoWinRT.dll","Windows.StateRepositoryPS.dll","MicrosoftAccountWAMExtension.dll","execmodelproxy.dll","policymanager.dll","D3DSCache.dll","Y5k5eVE1.dll","mobilenetworking.dll","capauthz.dll","vcruntime140_1_app.dll","StateRepository.Core.dll","Windows.StateRepositoryCore.dll","InputHost.dll","TileDataRepository.dll","directml.dll","Windows.System.Launcher.dll","Windows.StateRepository.dll","vaultcli.dll","biwinrt.dll","ieframe.dll","aadWamExtension.dll","DiagnosticDataSettings.dll","windowsudk.shellcommon.dll","xmllite.dll","wow64base.dll","StartTileData.dll","AppXDeploymentClient.dll","StartMenu.dll","vcruntime140_app.dll","D3D12Core.dll","DXCore.dll","Windows.Web.dll","Windows.ApplicationModel.dll","nlansp_c.dll","UserMgrProxy.dll","srvcli.dll","Windows.Storage.ApplicationData.dll","msvcp140_app.dll","wpnapps.dll","AppResolver.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef","sha256":"c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa","sha256":"339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"settings.json","sha256":"35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"urlref_httpstrksyln.netprojectstgm-gaming-macro-tgmacroinstalled","sha256":"c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"C:\\settings.json","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\trksyln-TMACRO","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Local\\SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Local\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"trksyln-TMACRO","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"Local\\SM0:3224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"Local\\SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}]}},"report_ids":{"sandbox_job_ids":["69f3d0f2728b2527ca09db69","69fbb24a72ad230fae00494d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L71","11",{}]] </article></body></html>

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 71:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7"],"about":{"@type":"SoftwareApplication","name":"TGMacro.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tad1,Found reference to API "Selected file does not exist." (Indicator: "select"; Source: "sample.bin"), Found reference to API "IsListeningForKeys+" (Indicator: "fork"; Source: "sample.bin"), Found reference to API "IsListeningForKeys+" (Indicator: "listen"; Source: "sample.bin"), Found reference to API "itemSelectedBackgroundColorKey" (Indicator: "select"; Source: "sample.bin"), Found reference to API "Open auto save macro directory." (Indicator: "open"; Source: "sample.bin"), Found reference to API "lSave all changes to the current project, overriding the existing file if it has already been saved. Ctrl + S" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ctClone" (Indicator: "clone"; Source: "sample.bin"), Found reference to API "ItemTemplateSelector+" (Indicator: "select"; Source: "sample.bin"), Found reference to API "(TGMacro.UI.Helpers.MacroTemplateSelector " (Indicator: "select"; Source: "sample.bin"), Found reference to API ")'Controls how closely colors must match." (Indicator: "close"; Source: "sample.bin"), Found reference to API "Specified Times" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Specified Times" (Indicator: "times"; Source: "sample.bin"), Found reference to API "PlacementTarget.SelectedItem+" (Indicator: "select"; Source: "sample.bin"), Found reference to API "AreaSelectWindow" (Indicator: "select"; Source: "sample.bin"), Found reference to API "teee" (Indicator: "tee"; Source: "sample.bin"), Found reference to API ""Wait Amount Range : (Milliseconds)" (Indicator: "mount"; Source: "sample.bin"), Found reference to API "_CreateDelegate" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "Select Target Image" (Indicator: "select"; Source: "sample.bin"), Found reference to API "AOpen an existing project file to continue working on it. Ctrl + O" (Indicator: "open"; Source: "sample.bin"), Found reference to API "Copy Selected Actions" (Indicator: "select"; Source: "sample.bin"), Found reference to API "txtSelectColorInput" (Indicator: "select"; Source: "sample.bin"), Found reference to API "Adjust Wait/Delay times" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Adjust Wait/Delay times" (Indicator: "times"; Source: "sample.bin"), Found reference to API "+Move selected actions to down {Ctrl + Down}" (Indicator: "select"; Source: "sample.bin"), Found reference to API " SelectedIndex+$" (Indicator: "select"; Source: "sample.bin"), Found reference to API "mc;http://schemas.openxmlformats.org/markup-compatibility/2006" (Indicator: "open"; Source: "sample.bin"), Found reference to API "WaitAmount" (Indicator: "mount"; Source: "sample.bin"), Found reference to API "Wait Amount : (Milliseconds)" (Indicator: "mount"; Source: "sample.bin")26:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp")27:T7d4," HTTP/1.1 301 Moved Permanently Date: Thu 30 Apr 2026 22:00:58 GMT Server: Apache/2.4.58 (Ubuntu) X-Redirect-By: WordPress Location: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with no response body "GET /projects/tgm-gaming-macro-tgmacro/installed/ HTTP/1.1 Host: trksyln.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:00:59 GMT Server: Apache/2.4.58 (Ubuntu) Link: ; rel="https://api.w.org/" Link: ; rel="alternate"; title="JSON"; type="application/json" Link: ; rel=shortlink Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 19935 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>3C21646F63747970652068746D6C3E0A3C68746D6C206C616E673D22656E2D5553223E0A3C686561643E0A090A093C6D65746120636861727365743D22555446....... "GET /adblock-check.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:00:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri 27 Feb 2026 05:53:55 GMT ETag: "13c0-64bc7dcc902c0-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1777 Keep-Alive: timeout=5 max=98 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2F2F203D3D3D3D3D204164426C6F636B20446574656374696F6E20536372697074202852756E2041667465722046756C6C2050616765204C6F616429203D3D3D....... "GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:00:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu 19 Feb 2026 11:12:29 GMT ETag: "b83-64b2b61568140-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1031 Keep-Alive: timeout=5 max=97 Connection: Keep-Alive Content-Type: text/css with response body ==>2E7770636637202E73637265656E2D7265616465722D726573706F6E7365207B0A09706F736974696F6E3A206162736F6C7574653B0A096F766572666C6F773A....... "GET /wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 18:29:08 GMT ETag: "18a45-64b1d5d142500-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 18595 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/css with response body ==>3A726F6F747B2D2D7468656D652D626F726465723A206E6F6E653B2D2D7468656D652D7472616E736974696F6E3A20616C6C20302E3132732063756269632D62....... "GET /wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 18:29:08 GMT ETag: "4e5-64b1d5d142500-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 518 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/css with response body ==>2E6865726F2D73656374696F6E5B646174612D747970653D747970652D315D7B746578742D616C69676E3A766172282D2D616C69676E6D656E74293B6D617267....... "GET /wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 18:29:08 GMT ETag: "1f5-64b1d5d142500-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 273 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/css with response body ==>2E777063663720703A61667465727B636F6E74656E743A22223B636C6561723A626F74683B646973706C61793A7461626C657D2E777063663720703A6C617374....... "GET /wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 18:29:08 GMT ETag: "79d-64b1d5d142500-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 519 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/css with response body ==>2E7770666F726D732D636F6E7461696E65723A6E6F74282E7770666F726D732D636F6E7461696E65722D66756C6C29202E7770666F726D732D6669656C642D6C....... "GET /wp-includes/blocks/heading/style.min.css?ver=6.9.1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue 04 Nov 2025 09:36:42 GMT ETag: "48d-642c191c51e80-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 211 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/css with response body ==>68313A7768657265282E77702D626C6F636B2D68656164696E67292E6861732D6261636B67726F756E642C68323A7768657265282E77702D626C6F636B2D6865....... "GET /wp-includes/blocks/paragraph/style.min.css?ver=6.9.1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri 31 May 2024 15:59:00 GMT ETag: "28f-619c20fd17900-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 341 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/css with response body ==>2E69732D736D616C6C2D746578747B666F6E742D73697A653A2E383735656D7D2E69732D726567756C61722D746578747B666F6E742D73697A653A31656D7D2E....... "GET /googleads.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue 03 Mar 2026 08:53:29 GMT ETag: "af7-64c1ad654b440-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 613 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/javascript with response body ==>76617220616473203D205B0D0A202020207B206E616D653A202779617A69636930272C20747970653A2027696E2D61727469636C65272C2068746D6C3A20273C....... "GET /wp-content/uploads/2026/02/logo-1.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 18:41:47 GMT ETag: "b80-64b1d8a5190c0" Accept-Ranges: bytes Content-Length: 2944 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: image/png with response body ==>C289504E470D0A1A0A0000000D4948445200000202000000C2950403000000C398C297C28F2D0000001E504C54456644C29B5647C29E000000544CC2A06C43C2....... "GET /old-site-content/images/adjust-timing.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri 31 Oct 2025 00:10:00 GMT ETag: "1dd-642692fba4600" Accept-Ranges: bytes Content-Length: 477 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: image/png with response body ==>C289504E470D0A1A0A0000000D49484452000000100000001008060000001FC3B3C3BF61000000017352474200C2AEC38E1CC3A90000000467414D410000C2B1....... "GET /old-site-content/images/multi-action.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri 31 Oct 2025 00:08:00 GMT ETag: "135-6426928933800" Accept-Ranges: bytes Content-Length: 309 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: image/png with response body ==>C289504E470D0A1A0A0000000D49484452000000100000001008060000001FC3B3C3BF61000000017352474200C2AEC38E1CC3A90000000467414D410000C2B1....... "GET /wp-content/uploads/2026/02/old-tgmacro-1.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu 19 Feb 2026 17:39:25 GMT ETag: "16f92-64b30c91e8d40" Accept-Ranges: bytes Content-Length: 94098 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: image/png with response body ==>C289504E470D0A1A0A0000000D49484452000003110000026E0806000000C38F64C28FC386000000017352474200C2AEC38E1CC3A90000000467414D410000C2....... "GET /wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue 21 Oct 2025 04:14:02 GMT ETag: "161d-641a36e0bb680-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1941 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2F2A2120546869732066696C65206973206175746F2D67656E657261746564202A2F0A2828293D3E7B76617220743D7B3530373A28742C652C72293D3E7B2275....... "GET /wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue 21 Oct 2025 04:14:02 GMT ETag: "14c2-641a36e0bb680-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 2229 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2F2A2120546869732066696C65206973206175746F2D67656E657261746564202A2F0A2828293D3E7B2275736520737472696374223B76617220743D7B643A28....... "GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu 19 Feb 2026 11:12:29 GMT ETag: "30e0-64b2b61568140-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 3503 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2828293D3E7B2275736520737472696374223B76617220743D7B643A28652C69293D3E7B666F7228766172207320696E206929742E6F28692C7329262621742E....... "GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu 19 Feb 2026 11:12:29 GMT ETag: "348c-64b2b61568140-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4265 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2828293D3E7B2275736520737472696374223B636F6E737420653D77696E646F772E77702E6931386E2C743D653D3E4D6174682E616273287061727365496E74....... "GET /wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 18:29:08 GMT ETag: "829e-64b1d5d142500-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 10055 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2166756E6374696F6E28297B76617220652C742C6E3D7B313631303A66756E6374696F6E28652C742C6E297B2275736520737472696374223B6E2E6428742C7B....... "GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue 21 Oct 2025 04:14:02 GMT ETag: "830c-641a36e0bb680-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 11852 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2166756E6374696F6E2872297B2275736520737472696374223B76617220742C652C6E3B743D5B66756E6374696F6E28722C742C65297B652831292C65283533....... "GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu 19 Feb 2026 11:12:29 GMT ETag: "3a6-64b2b61568140-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 483 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>646F63756D656E742E6164644576656E744C697374656E65722822444F4D436F6E74656E744C6F61646564222C28653D3E7B76617220743B77706366375F7265....... "GET /wp-content/uploads/2026/02/dotnetLogo.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 18 Feb 2026 20:33:57 GMT ETag: "19e9-64b1f1b753740" Accept-Ranges: bytes Content-Length: 6633 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: image/png with response body ==>C289504E470D0A1A0A0000000D49484452000004C2B0000004C2B00803000000C39CC3BF43C3BD0000000467414D410000C2B1C28F0BC3BC6105000000206348....... "GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 04 Mar 2026 07:36:06 GMT ETag: "bb7-64c2ddf73d950-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1282 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2828293D3E7B2275736520737472696374223B76617220653D7B7D3B652E673D66756E6374696F6E28297B696628226F626A656374223D3D747970656F662067....... "GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 22:01:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 04 Mar 2026 07:36:06 GMT ETag: "be6-64c2ddf73d950-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1298 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/javascript with response body ==>2828293D3E7B2275736520737472696374223B76617220653D7B7D3B652E673D66756E6374696F6E28297B696628226F626A656374223D3D747970656F662067.......3a:T29b4,"" - Source: "00000000-00002480.00000000.156111.6CF81000.00000020.mdmp") Found URL "https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed+ncalrpc:[ole6a84870559ae6051f14df6f8d8ff]:\users\hapubws\appdata\local\microsoft\windows\iecompatcache\??\c:\windows\assembly\nativeimages_v4.0.30319_32\uiautomationtypes\:\windows\assembly\nativeimages_v4.0.30319_32\presentatio5ae0f00f" - Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport.0.0.0.0.0.0m32\h:\programdata\microsoft\windows" - Source: "00000000-00002480.00000001.158032.04A20000.00000004.mdmp") Found URL "https://gettgmacro.com/manifest.jsoneaveallocateddl2.dlldl_framebuffer_acceleration" - Source: "00000000-00002480.00000001.158032.05B40000.00000004.mdmp") Found URL "http://scripts.sil.org/oflapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimeen-usen-usen-un-usen-usen-usn-usn-usn-usn-usn-usn-usn-usn-usn-usn-usersion" - Source: "00000000-00002480.00000001.158032.07140000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002480.00000001.158032.07140000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/30" - Source: "00000000-00002480.00000001.158032.08A70000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/30" - Source: "00000000-00002480.00000001.158032.08A70000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002480.00000002.159951.02A80000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport.0.0.0.0.0.0m32\h:\programdata\microsoft\windows" - Source: "00000000-00002480.00000002.159951.04A20000.00000004.mdmp") Found URL "https://gettgmacro.com/manifest.jsoneaveallocateddl2.dlldl_framebuffer_acceleration" - Source: "00000000-00002480.00000002.159951.05B40000.00000004.mdmp") Found URL "http://scripts.sil.org/oflapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimec:\windows\fonts\en-un-usen-usen-usi.t(n-usn-us[hi_ed0)$&+'n-usn-usefj_cpwedihijklmnopqrstuvwxyz" - Source: "00000000-00002480.00000002.159951.07140000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002480.00000002.159951.07140000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l)" - Source: "00000000-00002480.00000002.159951.08810000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/30" - Source: "00000000-00002480.00000002.159951.08A70000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/30" - Source: "00000000-00002480.00000002.159951.08A70000.00000002.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcszjxthawte," - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?edigicert" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;jyc+se]l+>%ydigicert" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pca3.crl0washington1redmond1microsoft" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkx" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "https://trksyln.net/projects/tgm-gaming-macro-(tgmacro)-4/" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "https://discord.gg/gj5znt4aaw" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://microsoft.com0washington1redmond1microsoft" - Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=247104.&click" - Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" - Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257the" - Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.the" - Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.s'<0s>'" - Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport.0.0.0.0.0.0m32\h:\programdata\microsoft\windows" - Source: "00000000-00002480.00000003.165464.04A20000.00000004.mdmp") Found URL "https://gettgmacro.com/manifest.jsoneaveallocateddl2.dlldl_framebuffer_acceleration" - Source: "00000000-00002480.00000003.165464.05B40000.00000004.mdmp") Found URL "http://scripts.sil.org/oflapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimec:\windows\fonts\en-uen-usi.t(n-us[hi_ed0)$&+'efj_cpwedihijklmnopqrstuvwxyz" - Source: "00000000-00002480.00000003.165464.07140000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002480.00000003.165464.07140000.00000004.mdmp") Found URL "https://gettgmacro.com/manifest.jsoneaveallocateddl2.dlldl_framebuffer_acceleration" - Source: "00000000-00002480.00000003.165464.07380000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l)" - Source: "00000000-00002480.00000003.165464.08810000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/30" - Source: "00000000-00002480.00000003.165464.08A70000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/30" - Source: "00000000-00002480.00000003.165464.08A70000.00000002.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcszjxthawte," - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?edigicert" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;jyc+se]l+>%ydigicert" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pca3.crl0washington1redmond1microsoft" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkx" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "https://trksyln.net/projects/tgm-gaming-macro-(tgmacro)-4/" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "https://discord.gg/gj5znt4aaw" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002480.00000003.165464.098C0000.00000004.mdmp")4a:T4d6d,GET /projects/tgm-gaming-macro-tgmacro/installed HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /projects/tgm-gaming-macro-tgmacro/installed/ HTTP/1.1 Host: trksyln.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /adblock-check.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-includes/blocks/heading/style.min.css?ver=6.9.1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-includes/blocks/paragraph/style.min.css?ver=6.9.1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /googleads.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /wp-content/uploads/2026/02/logo-1.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /old-site-content/images/adjust-timing.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D GET /old-site-content/images/multi-action.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D GET /wp-content/uploads/2026/02/old-tgmacro-1.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D GET /wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D GET /wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D GET /wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973 GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973 GET /wp-content/uploads/2026/02/dotnetLogo.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973 GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973 GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.1777611973 4b:T53ad,Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/plugins/gtranslate/flags/svg/en.svg HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29 HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29 HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/uploads/2026/02/cropped-tgm-32x32.png HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1pp" in header "GET /wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29 HTTP/1.1Host: trksyln.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h0" Contains base62 string in header "45Pe64t1v9106823843za200zb9245232" in header "POST /g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968 HTTP/2Host: analytics.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://trksyln.net/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Origin: https://trksyln.netPriority: u=1, iAccept: */*Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "45Pe64t1v9106823843za200zb9245232" in header "POST /g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468 HTTP/2Host: stats.g.doubleclick.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://trksyln.net/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Origin: https://trksyln.netPriority: u=4, iAccept: */*Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9M" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzG" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"4c:Ta45,Found HTTPS GET request to https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed Found HTTPS GET request to https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Found HTTPS GET request to https://trksyln.net/adblock-check.js Found HTTPS GET request to https://trksyln.net/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5 Found HTTPS GET request to https://trksyln.net/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29 Found HTTPS GET request to https://trksyln.net/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29 Found HTTPS GET request to https://trksyln.net/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29 Found HTTPS GET request to https://trksyln.net/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29 Found HTTPS GET request to https://trksyln.net/wp-includes/blocks/heading/style.min.css?ver=6.9.1 Found HTTPS GET request to https://trksyln.net/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1 Found HTTPS GET request to https://trksyln.net/googleads.js Found HTTPS GET request to https://trksyln.net/wp-content/uploads/2026/02/logo-1.png Found HTTPS GET request to https://trksyln.net/old-site-content/images/adjust-timing.png Found HTTPS GET request to https://trksyln.net/old-site-content/images/multi-action.png Found HTTPS GET request to https://trksyln.net/wp-content/uploads/2026/02/old-tgmacro-1.png Found HTTPS GET request to https://trksyln.net/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 Found HTTPS GET request to https://trksyln.net/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 Found HTTPS GET request to https://trksyln.net/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5 Found HTTPS GET request to https://trksyln.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5 Found HTTPS GET request to https://trksyln.net/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29 Found HTTPS GET request to https://trksyln.net/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 Found HTTPS GET request to https://trksyln.net/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5 Found HTTPS GET request to https://trksyln.net/wp-content/uploads/2026/02/dotnetLogo.png Found HTTPS GET request to https://trksyln.net/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js Found HTTPS GET request to https://trksyln.net/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js4d:T4ac,Short term registered certificate: "analytics.google.com" (83 days old) Short term registered certificate: "clients2.googleusercontent.com" (83 days old) Short term registered certificate: "ep1.adtrafficquality.google" (83 days old) Short term registered certificate: "ep2.adtrafficquality.google" (83 days old) Short term registered certificate: "fonts.googleapis.com" (83 days old) Short term registered certificate: "fonts.gstatic.com" (83 days old) Short term registered certificate: "fundingchoicesmessages.google.com" (83 days old) Short term registered certificate: "gettgmacro.com" (89 days old) Short term registered certificate: "googleads.g.doubleclick.net" (83 days old) Short term registered certificate: "pagead2.googlesyndication.com" (83 days old) Short term registered certificate: "stats.g.doubleclick.net" (83 days old) Short term registered certificate: "tpc.googlesyndication.com" (83 days old) Short term registered certificate: "trksyln.net" (89 days old) Short term registered certificate: "www.google.com" (83 days old) Short term registered certificate: "www.googleapis.com" (83 days old) Short term registered certificate: "www.gstatic.com" (83 days old)4e:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp")4f:T5ed,Found string "+ncalrpc:[OLE262D38AC40ED97C803368AA2793D]" (Indicator: "ncalrpc"; Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found string "+ncalrpc:[OLE6A84870559AE6051F14DF6F8D8FF]" (Indicator: "ncalrpc"; Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.088AA000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.088AA000.00000004.mdmp") Found string "F+ncalrpc:[OLE262D38AC40ED97C803368AA2793D]" (Indicator: "ncalrpc"; Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found string "F+ncalrpc:[OLE6A84870559AE6051F14DF6F8D8FF]" (Indicator: "ncalrpc"; Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.088AA000.00000004.mdmp, 00000000-00002480.00000003.165464.088AA000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp")50:T1489,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.088AA000.00000004.mdmp, 00000000-00002480.00000002.159951.0DD20000.00000002.mdmp, 00000000-00002480.00000003.165464.088AA000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.08810000.00000004.mdmp, 00000000-00002480.00000003.165464.08810000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.088AA000.00000004.mdmp, 00000000-00002480.00000003.165464.088AA000.00000004.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp")51:Tfa8,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp")52:T4e8,Found reference to API "SDL_GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp") Found reference to API "VkKeyScan" (Indicator: "VkKeyScan"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.073B0000.00000004.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.073B0000.00000004.mdmp") Found reference to API "79185693197,928,104,,GetKeyState,user32.dll,"00:41:07.437",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002480.00000001.158032.088AA000.00000004.mdmp") Found reference to API "129615886198,928,104,,GetKeyState,user32.dll,"00:41:28.453",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp")53:T9e4,"" (Indicator: "password"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp")57:Td29,Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00002480.00000002.159951.0DD20000.00000002.mdmp")58:T547,Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp")59:Te86," "504F5354202F672F636F6C6C6563743F763D32267469643D472D4A48324D4E51315758592667746D3D343550653634743176393130363832333834337A613230307A62393234353233323437387A6439323435323332343738265F703D31373737363131383038303936265F67617A3D31266763733D47312D2D266763643D31336C336C336C336C356C31266E70613D3026646D613D3026746366643D313030303026676469643D645A544E694D54265F65753D4141414141474143265F7072733D6F6B266172653D31266369643D3139333338363337322E313737373631313937332666726D3D3026707363646C3D6E6F617069267263623D372673723D3132383078383030267561613D783836267561623D363426756166766C3D4E6F742532353341412D4272616E6425334239392E302E302E302537434D6963726F736F66742532353230456467652533423134352E302E333830302E35382537434368726F6D69756D2533423134352E302E373633322E37362675616D3D2675616D623D30267561703D57696E646F777326756170763D352E302E30267561773D3026756C3D656E2D7573266761663D32265F733D31267461675F6578703D307E3131353631363938357E3131353933383436367E313135393338343638267369643D31373737363131393733267363743D31267365673D3026646C3D687474707325334125324625324674726B73796C6E2E6E657425324670726F6A6563747325324674676D2D67616D696E672D6D6163726F2D74676D6163726F253246696E7374616C6C65642532462664743D54474D6163726F253230496E7374616C6C65642532302D25323074726B73796C6E26656E3D706167655F76696577265F66763D32265F6E73693D31265F73733D32265F633D31265F65653D31266761702E706C663D352665702E676F6F676C65736974656B69745F706F73745F747970653D70616765267466643D3539363820485454502F320A486F73743A20616E616C79746963732E676F6F676C652E636F6D" HTTP/2 204 No Content Content-Type: text/plain Access-Control-Allow-Origin: https://trksyln.net Date: Thu 30 Apr 2026 22:01:03 GMT Server: Golfe2 Expires: Fri 01 Jan 1990 00:00:00 GMT Access-Control-Allow-Credentials: true Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"ascnsrsggc:196:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}] } Cache-Control: no-cache no-store must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Pragma: no-cache Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ascnsrsggc:196:0 with no response body "POST /g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468 HTTP/2 Host: stats.g.doubleclick.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://trksyln.net/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Origin: https://trksyln.net Priority: u=4, i Accept: */* Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F672F636F6C6C6563743F763D32267469643D472D4A48324D4E5131575859266369643D3139333338363337322E313737373631313937332667746D3D343550653634743176393130363832333834337A613230307A62393234353233323437387A6439323435323332343738267263623D37266169703D3126646D613D30266763733D47312D2D266763643D31336C336C336C336C356C31266E70613D302666726D3D30267461675F6578703D307E3131353631363938357E3131353933383436367E31313539333834363820485454502F320A486F73743A2073746174732E672E646F75626C65636C69636B2E6E65740A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134352E302E302E30205361666172692F3533372E3336204564672F3134352E302E302E300A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D53746F726167652D4163636573733A206E6F6E650A526566657265723A2068747470733A2F2F74726B73796C6E2E6E65742F0A5365632D46657463682D536974653A2063726F73732D736974650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F74726B73796C6E2E6E65740A5072696F726974793A20753D342C20690A4163636570743A202A2F2A0A5365632D43682D55613A20224E6F743A412D4272616E64223B763D223939222C20224D6963726F736F66742045646765223B763D22313435222C20224368726F6D69756D223B763D22313435220A5365632D43682D55612D4D6F62696C653A203F300A5365632D43682D55612D506C6174666F726D3A202257696E646F7773220A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C206272" HTTP/2 204 No Content Content-Type: text/plain Access-Control-Allow-Origin: https://trksyln.net Date: Thu 30 Apr 2026 22:01:03 GMT Server: Golfe2 Expires: Fri 01 Jan 1990 00:00:00 GMT Access-Control-Allow-Credentials: true Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"ascnsrsggc:164:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0"}] } Cache-Control: no-cache no-store must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Pragma: no-cache Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ascnsrsggc:164:0 with no response body "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"W3OKCXaV4TYRqupjdJ/W0r5rCg5hKAGcMK8HsYbtp+o=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 30 Apr 2026 22:01:10 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......5c:Ta3a," { ,~s= o? *0]{ ,+L~s; o@ ~s= oA ~s= oB }*0{,+{(: {Yl#@@Z~C l[}{l ,B{(D {s%iooE ,(F *U(} 0g({ (D {s%{ , (G +(H o%{ ooE ,(F *J[0({ (D {s%(I o%(J .+o%{ , (G +(H o%{ ooE ,(F *m~0^({ (D {s}%(K ot%(L .+oxoE ,(F *ARs% }}}}}}} (% *0' >(&{{sM +*0 2 (N (O + 9A(5 (P A (N (O - (N (O + (N (O - (N (O + `,n{_{~o,-( +,7~{(+,~-+oR (N +~(0 + *6sS '*0sT P{U , [+, [oV P{W , \+, \oV P{X , + , oV P{Y , +, oV P{Z , +, oV P{[ , +, oV o\ +*08s ,+#(4}s] (++*04 rp(_ (` (a (b +*0 (c (d (8 (6+*0O~9 (* (+~9 (,& _ _c _c (e +*06~~of (= rp(g (h &*-.0rp(i ,}~rp(j o+~, (*"}>*{?*"}?*j(f(h(j*{A*"}A*{B*"}B*{C*"}C*{D*"}D*{E*"}E*{F*"}F*{G*"}G*{H*"}H*{I*"}I*{J*"}J*{K*"}K*{L*"}L*{M*"}M*{N*"}N*{O*"}O*{P*"}P*{@*B}@( *{R*"}R*{S*"}S*{T*"}T*{U*"}U*{V*"}V*{W*"}W*{X*"}X*{Y*"}Y*{Z*"}Z*{[*"}[*{\*"}\*{]*"}]*{^*"}^*{_*"}_*{`*"}`*{a*"}a*{b*"}b*0}@}B}C}D}E}F}Gx}H}I}J}K}L}M}N}O}P}Q}R$}T6%}Uy}Vr-p}W}Y}Z}[}\}]}^% % }_(% *{c*"}c*{d*"}d*{e*"}e*zr7p}cs }e(% *{f*"}f*{g*"}g*{h*"}h*{i*"}i*{j*"}j*{k*"}k*{l*"}l*{m*"}m*{n*"}n*{o*"}o*{p*"}p*{q*"}q*{r*"}r*{s*"}s*&(% *0!(% oO(oYo(oQ( (oYo(oYu ,YoK(oO(oM%-&+)~%-&~3s %(+(+(oYu,YoC(oG(oE%-&+)~ %-&~4s % (+(+(oYu,Mo=(o?~%-&~5s %(+((oYu 9 o((r}p o* (_ o* (` o* (a (b (rp o, (c o, (d ( ( o0( ( o.( o2(s oY{o +( so ( -o o (*'{t*"}t*{u*"}u*{v*"}v*{w*"}w*{x*"}x*{y*"}y*{z*"}z*{{*"}{*{|*"}|*{}*"}}*{~*"}~*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*&(% *0"(% o(u ,Po(o(c ( rpo(d ( ( (u9o(o(c ( rpo(d ( ( (o(o({(o%-&+)~%-&~8s %(+(+(u,Yos(ow(ou%-&+)~%-&~9s %(+(+(u , o(u,og(u!,,o(o(o(u,\o\(s +o^so Xo^i-o (u 9r}po(_ o(` o(a (b (rpo(c o(d ( (o(o(o(u9o(rpo(c o(d ( (rpo(c o(d ( (o(o({({(u' ,, o( o ( o( u" ,, o( o( o(*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*Nrp}(% *{*"}*{*"}*"(% *{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*0}}}}(((+(-()7s s }{o {o s%(*}%(c lo %(d lo (6sc(*F(}*0 ,}*0r#8d+'}(,(( ( ,(+-(2-%(,(c (,(d sM +(! (c (d (8(*(8(.kX"B( ,*(,"((_-((3+++,D(0,{+,+b}( ,(( +;(0-+ , (.{+ , (( 80e$(_ (_ Y( (` (` Y( (a (a Y( XX "? k"@?D[Y"BZ+*{*"}*b}((*0 rp +*{*"}*{*"}*}(((@(>BsF(+*0a%( ,(+,(8:(?~%-&~s] (+,|(L + ,(_,(C3|(L + ,#(, (+(*{*"}*{*"}*{*"}*0js }}( ,6((P(L(N(~Rs= o> *0l'( ,(+,( ,(88(MP(5 (I (O_,(K-(J +,(_,(K3(J +,((J ,{(I o &+#(J ,{(I o &(K,-{(Oo _ , (+(_,(K3(J + ,#(, (+(* *F((*{*"}*rp* *0((\,(\ ( +rp*0A(y%(U%rp%(Y%rp%{i ( ( * *{*"}*0){ +*&}*0H*(\ ,+ (a++G ,+(aX(\-*0C+{ +/G ,+(oo,o!Xi2*0H,( t {~%-&~As %(+(+}+*rp}}:}(% * * *r p*{*"}*(g*0-( +* *Nr p}(% *{*"}*r= p*6(w*0p.~ (u,:+'(u66o, rap( X(ui -(s)o (3 +* *{*"}*{*"}*{*"}*0/G ,8(wEAW+k(z(s( , (+( (s( ({+,(z(s( +(s( ({+*0>0(u%-&+ ,'+(u( X(ui-*0>0(u%-&+ ,'+(u( X(ui-*0-( +*~ }}}(% *{*"}*rO p*6(*0&1~ (,:+'(66o, rap( X(i -(Ko, (3 ((c -((d -(+,}y%%r[ p%(,rc p+rm p%rw p%((c ( %r p%((d ( %r p( +* *{*"}*{*"}*{*"}*{*"}*{*"}*02G,8( ( E`8((({( , (+( (({( (+F((({( +#(({( (+*0>0(%-&+ ,'+(( X(i-*0>0(%-&+ ,'+(( X(i-*0-( +*~ }}}}<}(% *r p* *0e3y%(,rc p+rm p%rw p%( (c ( %r p%( (d ( ( * *{*"}*{*"}*0G ,+((( *0-( +*>}(% * * *r p*F{{4(*J(sL}*014r p( (c ( (d ( *{*"}*{*"}*{*"}*{*"}*}}(% s}*0-( +*05 8{((c ((d ((c ((d {((o( ,h( (c ( (d (M {,( <( +{,( ( -{+G`,+2( :*r p* *(* *{*"}*0G ,+(( *0-( +*Nr p}(% *{*"}*r p* *06~ (,r p(3 +r? p(3 (,ro p(3 +7rp( (c ( (d ( (3 +*2(( * *{*"}*{*"}*{*"}*{*"}*{*"}*078G,8( (c ( (d (M (,(! (c (d (8(((kX"B,(+,+'-(+,+( 8O*0-( +*0e$(_ (_ Y( (` (` Y( (a (a Y( XX "? k"@?D[Y"BZ+*Z}}(% *r} p* *0C((-( ( r p(3 + r p((( * *{*"}*{*"}*{*"}*0]8G,+S( (,((+,{((Xo , (+( *0-( +*@} }s }(% *{*"}*{*"}*{*"}* * *r p*0V9r p(,( )o +(Ko, r p(,rp+rp( *0-( +*0:}( ,~s; o< (,~s= o> +( {-G+-~s; o@ ~s= oA *0.(I (3(J (+ ,}*0.(K (3(L (+ ,}*}}}}(% *0( }( r p( ( ( ( ( ( ( ( ( #4@( #4@( #4@( #4@( #4@( #4@( *0B;( ( - +(( %-& +o ( s #?( - +(( %-& +o ( s #?( ( [( ( [( ( [( ( [( ( [( ( [( ( [( #@[Y( ( [( #@[Y( (*0<( ( #@[#@Y ( #@[( #@[( ( #?s #?X#?Xo |( |(_ |(` |(a ( s #@s o *0'=s ( ( `(&*0;>( o 8 o , o o +,8 o o ,8 o ( %-&o , o, ( o +co -&y(5 ( -д(5 ( + , ( o +o o r'p o (b s zXi? + *x,0?s! o" o# 8 o o$ , o o% T(5 ( + ж(5 o& o' -,o, (( -+,,+, o o) Xi?` + *0o* ( o+ + +*0@%(5 +*"(, *{*"}*"(% *{*"}*{*"}*{*"}*{*"}*{*"}*02As%(o%(o%(o +*Bx}(% * * *rp*Zrp(rp( *{*"}*{*"}*{*"}*0-( +*0B+u(( (" 2( ~9 (O ,+F(#-(+,! ()&("&('&2( (# ,+G-*"(% *0C,8l#-@[(- #-@Z (. +po/ (0 Y#,+G#-@, ( +$#?, ( +d(1 +*0#D( (+*0#EsB }} }"}#o }$o {0}{1}{{$0{+ ,8{$s &o o }o ( }{3}{2}oJ}|s% }!{YCs2 (3 &o {+*0F{,"{o 3{o + ,J{%-&+(4 {%-&+( &s }{( }{s5 o6 {+*0:Gs7 ( s5 o6 ,o +*)0aHs8 o9 ԍio: &s; s< s= ! o o o *(3 =+H IS02Is> (? o@ oA (B ,o *%0&J(C s; s< ,o * F}(% *{*{*"}*{*"}*{*"}*0A(. }(% ( , #@@l[(*0K( ,+|+( (o/ (0 (-(o/ (0 ((X ,(o/ (0 (((X(*0BLsD }%}&~9 }'Es~9 (#&{'+*0(&, (((O + +*0"Ms s4 8oD ,8 u, ow- u,o++ ,o 8 u ,<~ on(%,o + oE +D u ,/(%,o + oE +Xi:oF +*0NX 8Po" o" ( 9u ,'u, osos3ow+,+\u,(u,oo3o+ ,+X Pi :L+*0OOo" o, oG h(5 oH t#,+,oI + o, + *0'P~ (/ tS(+ 3*0'P~ (1 tS(+ 3*0'P~ (/ tS(+ 3*0'P~ (1 tS(+ 3*0'Q~ (/ tR(+ 3*0'Q~ (1 tR(+ 3*.~oJ * (@&0s s ~o ~o *0{R~oK Y +1~(+(M (~(M oN &Y -~,~oO + ,~oP (C*0S88n{ PYET8:{{(( ~9 (Q , ~ oR ~%-&+ oK8{{~oK Y +k~ (+(M ((,:(M (~%-&+ (S oK~(M oN &+ Y -8P{{{{,= .,*~%-&+ oG~%-&+ oG+F,; .,*~%-&+ oG~%-&+ oG8~{{oT ,~{{oU ~%-&+{{oG+P~{{oT ,~{{oV &~%-&+{{oG+ (=:}( 8gVsW sX *0&T rp( -+~+~+*B(% }*0\U~9 (O , +F( +X G-( Y[jԍi(Y (g oZ + *0pV , ~9 +[uy ,rpr%ps[ z(g o\ iX(N (;i(] ( iXR+* *0{ , (<*0( +*^s3s3*0Wb`b`b` +*0X(2 _{V}O{W}P{Xo^ }Q{Yo^ }R{Z}S{ZZ+kZ{[[{A}>{[[{B}?{[[{Co^ }@ZX{Z-|\(_ ,:^(5 (` (a }U|\(b ^{U(c Z (d }T(\ {U(e +Z{@of X{Z-{Rof {Qof + *^}]}^}_*0( ZdZXX +*0~.(` +*0 ( ` +*0j n_ j +*0 ( /` +*0j n_ /j +*0W(: +*0$W b`b`b`b`` +*0Yd_ +*0Yd_ +*0Yd_ +*0Yd_ +*0 Yd_ +*0AZ( ,)~T.~U. ~V+ ++ _+*0+[(,+( . .++*0/\(,+( .. .++*0-(+ +*0']v(5 (P v { _+*0^r;p(= ( +*0=rAp(= (%+*0 Y(D +*0 _ @` +*0WY_b +*0=r;p(= (+*0` _ +*0 _ +*0 _ +*0 _ +*0 _ +*0 _ +*0 _ +*04ar;p(=(Ц(5 (P + *0Y +*0(`.3(4(5(6(7(8(9(:(;(<(=(>(?(@(A(B(C(D(E(F(G(H(I(J(K(L (M (N (O (P (QYV12(RIYUV(SYUY2(TUYVY(UYVYU(V(hi(hj(hk(hl(hm~g - +~g - + ~g - + ~g - + *0Mbsh ,(i + , oi 8#(j rGp(j ok 8ol tuom on oo op (y ,8% % oq +k op or % os i,+0sb% o_% (+(+oaou X i2ov :"uA,o oi +*E*0ycs4 (i,oF 8S83o^rupow ,no`ox 2,o`oy (( ,o`oy (( +,&s%o% sM ooE 8o^rpow ,no`ox 2,o`oy (( ,o`oy (( +,&s%o% sM ooE 8o^rpow ,Io`ox 2o`oy (( +,s%ooE 8o^rpoz -o^rpoz ,%o`ox 2o`oy (( +9o^rpoz -+o^rpo{ ,F~o| -+,s}%ox%otoE 8o^rpo{ ,\o`ox 2o`oy (( +,*s%o% [o%ooE 8|o^rpo{ ,\o`ox 2o`oy (( +,*s%o% \o%ooE 8 o^rpo{ ,+7o^rpo{ !!,+o^rpo{ "",##,)s%o%o%ooE +}o^rpow $$ 's%o%o%ooE +?o^r pow %%,'s%o%o%ooE +Xi?oF + *0s} %)o~ %:po~ %;qo~ %to~ %?uo~ %@vo~ %Awo~ %Bxo~ %Cyo~ %Dzo~ %E{o~ %F o~ %G o~ %Ho~ %S o~ %I-o~ %5 o~ %1o~ %2o~ % 3o~ %!4o~ %"5o~ %#6o~ %$7o~ %%8o~ %&9o~ %'0o~ %- o~ %. o~ %*o~ %Too~ %Ujo~ %Vmo~ %L.o~ %+ o~ %Qo~ %Wo~ %Eo~ %Ro~ %To~ %Yo~ %Uo~ %Io~ %Oo~ %Po~ %/ o~ %0 o~ %1 o~ %_go~ %`ho~ %aio~ %J$o~ %9o~ %Ao~ %So~ %Do~ % Fo~ % Go~ %Ho~ % Jo~ %Ko~ %Lo~ %3 o~ %4 o~ %X o~ %\do~ %]eo~ %^fo~ %M#o~ % o~ %Zo~ %Xo~ %Co~ %Vo~ %Bo~ %No~ %Mo~ %6 o~ %7 o~ %8 o~ % o~ %R&o~ %Yao~ %Zbo~ %[co~ %K!o~ % o~ % [o~ % o~ %, o~ % o~ % \o~ %e]o~ % o~ %P%o~ %Q(o~ %O'o~ %b`o~ %cno~ %Wko~ %N"o~ *{*"}*&{*0J}-(+ ,({%-&+rps o (*&{*0:({ ,+g(, ( +,}+ }{, ({}{%-&+od*{*"}*{*"}*0)d{ (/ t|( + 3*0)d{ (1 t|( + 3*0)e{ (/ t|(!+ 3*0)e{ (1 t|(!+ 3*0}}s}}s4 }}}}(% %s(~s; o< s s %o }{o *0f(,8(o,(o+ ,+y(o,/(oi2(oP(o(5+ (K (o3(L +_,((*0 ,(*0:(, (o+ ,O(os }(o,}}+(o}+J~ozs }~o|,}}+~oz}*0fg8X( , ( 8={%-&+oh8{o o,8( , }8{,!{o |{o+{o |{o{,{o o+,{o!X{o :2{, (+{,( &( ,({%-&+oh 80h("+Zs o 8o u 5 obto^((+o_oE +oE o.o.+,8!u ,xow ,8ow,s%ooE 8ow,'0+Y s% ooE 8u,no,+po,s%ooE +Io,#0+Ys%ooE +s%ooE ov :Z,o +*A0i{oF ($ 8 u,ow+,Nos( ou,.ou + ( X i2 u,o+,Po<( o,.o + ( X i2Xi?*0hj{, {oO + ,{oP {, {oO +,{oP (({o *0k{,~{Q+ (,o3t(2+,!,(o +(o {,{o + 9{~%-&~ms %(#+o 8o t o,8o, sooo}oo (c lo oo (d lo ,oo &+ oo ov :6 ,o *O`у 0l( ,(o ({9{~%-&~ns %(#+o +9o t o,oo oov -,o *eE0m{ ,,{o + t(Xi2{,6{o +t(Xi2*0) { (/ tI|(+ 3*0) { (1 tI|(+ 3*"(% *6{($+*"(% *0s %o %{o %r po ( &M&r% p(i ,:s %r% po %{o %o %r po ( &*01M"(% *0kn{ ,++ (w ,++Ar p(@o ( -C% }}|(%+{|-% }( }{}}{(y ,z~{o&+}{o(y ,{o {oop {ow ,{(}}&}|( }|( *A45,5<,*"(% *0Do{ ,++ (w ~ },++s },++R{{o o ( ( -D% }}|('+ݰ{|/% }( }{}}/{,{o }{,&{!}}|( }}|( *(:&!,*"(% *0p{ ,++fs}{{}{s ( o ( -@% }}|((+`{|9% }( }}| ( }}|( *,*.s%*"(% *"s *o *.s)*"(% *2(&*"(% *R{{(V*"(% *0Kq{{(T{ ,'{ %-&/s %} ( &*08rso (m }}}|()+|(o *0{% (T*.s2*"(% * * * *.s7*"(% * * *.s;*"(% *2(-o *"(% *>|(K *.s@*"(% *2o t:*"(% *0s|( ,88|( ,88{{ {,X{ZX{ {+XZXXG{ {-Y( {0JXG{ {.Y( {0%G{ {/Y( {+,+X{i :- ,8 8{{ZX{X{ZXZX 8ZXXG ,+mX XGXGY( {0A XXGXXGY( {0# XXGXXGY( {+, X X{:\X{:1 ll[{ +,v{!(D |( ,2{[X{"X{[X{#XsM s } ,(F o +!X{${Y:I*HT "(% *0zt(& ,+d s o ($&o, {%-{&o + {&o , }'++*{*"}*{*"}*"(% *.sl*"(% **o**o*"(% *0u{ ,++> ( o ( -C% }}|(*+ݒ{|9% }( ( o {{ %- &{{0s % } o++&}|( }|( *,*BSJBv4.0.30319l#~4<#Stringsp #US\#GUIDl7#BlobW 3q:"#T 'u '2 +OwfxfxfvÜkvwwx=x~xwWvGuGbww|ܡwܡuufx>t#v7wlfdOp ?iɖsΰ |xNllMl ~}xp~[vfvHSofgfwff;f)͒fuPuT+tɃ>vɃFr?kE~?Nh|y~o t RɃݕɃgMNxvfɃ xdO"dOQk΅&GgG*TM~M* G i dO dO~؆mnM46X46tTwɃP{& dOGNUGwGxwfvfâJudOsTdO~g&\GfR{WlN{{.7{.G"ky|}l46̔m"pm8޼Qr?j~h|7l~hh|"ꀸjK|&ňG*4{*{*+{ 㺸{Ae48s4~&>G4G&7mGMM&фMMMMMM& V\k vi{ 僗۰Y{~~h4646^46uh|S}N颽㒽wqE֢^ YqYǓqYqY!qY(4?Y(C?*G ֠+J!֠Y0J|֠Y7O ֠=e֠Y@l֠Ycǣ֠Yf֠YtZ֠Y;֠Y#>(W9,=C𔬣KKS􉔢YU$YdNYm`Y~YY2YYYoY2YYqIYY=uYSYYėYY")Y$)Y&hY':Y2,:Y:eeedeeetee.mYŉ5rY}} O}O}DC_YYYYY!!&OY$!&OY(%Y+;Y-!&OY1!&OY6!&OY:Y=!&OY?YBY%Ds}(Fqs}(JȄ(N+N/N}7N7R;RN>R &NAR DRpGR nNRnNOR wNVR ]Rg`RUeRl~RķR5RƞR hRRuRRsR aR,/R?/RS/R R 3uR R R R fe RpR >R @R αIR NQR WR [R ȲgR qR `wR R qR R R HR ݲR R R !R 7R R R -R RRٗ}RViVjV6eV _VV dVoVVV VbV ъ V "V HO-V K;V GV SV WVeVlV 5OpV;}xVM}xZ"x^ ^ ʏ^ ^ ޏ^ %^^ ^Y^}c2}g!&OYkPYo Pr r r !'!!&X!&!&g!&Q!.!N!^!n|t!Wt!!! R!U!U!U!iZZ\\T`s`V_!W\\^|_Y_;_Q\Z!o^!a!'^!wa!X6"V5"VJ*"VM"Vm;"V$"V'"V2VV1!V=!VG!V.!VM6!V5!V:!VhH!VG!VX!V!VA !V,!V !V!Vf!V!V"!V!V/!VU1!V1!VR-!651!V+!V)+!V*!V!65"6"6'"6"6["6"6;"6"6@ "6W "6"6l"6"6"6"6"6 "6)"6n "6 "6"6A"6"6"6"6"6U"6#"6n"6<"6o"6"6nI"6"6KM"6I"VH"V"V "V"V!V!V%!V%!VL!Vo"!V !V!VE+!VCD"V- "V8E"V"V"6*"6*"6*"6*"6*"VP"V!V8!VIE!V)5!VSD!V8!V4!Vr8!V4!VF"V "VD"Vo "V7"V3"Va'"V;"V"V72"V/"V%1"V;"VA"V?#"V9:!V/!V+!V7M"V$"V!"V/"V"V"V~"V"V "V"Vu"V"V"V"VN"V"V"VA"V"6A"6A"6A"6A"V"Vo"VO"V"V !M!Vs"Vꍟ"Vj"V"VJ"Vݒ"V"VO"Vj"V"V"M!V"V"M!VH"VH"VH"M!V("VGb("V)l("Vr("M!Vs"Vꍤ"Vj"V"VJ"M!V殩"V"Vb"Vn"V"V="M!V"Vf"V"M!V8s"VAe"V."V""kt!&aV"t"]"GY"Q">Q"uP"P"y!ї" R!K!M!g!g! !o!!Bu!"|W !"u!"|( " "u!"B"#6# ##6*#Q/#:#W:#u"5 >#F#6P#rU#1U#`#6k#DU#U#6p#u#N#6##Sc#dr!!g!Ag!jr!g!=!u!rb"!~K!M!6!F-mM!V##Vn$#M!V:F#VG,#VD#M!V##V'#V6#Va3#V=#V+#V>#M"Vp=#VJ'#V1#M"VsF#VKF# ##U!ͷ ##U!ͷ^!~!$O!M!VU#VH#V:#V.#VF#VJ#᥿# # -mj/!2n # -mj/!2#n#{!!t!M!V!#V#V#V#M!V%#V%#V2%#V$#V%#V:#VZ%#Vl%#V%#V%#VC%#V$#V6#V&@#V>#V #V'#Vg1#V1#V-#V*?#VX+#VH#V#M!VS"#VM#V?#M!V&#V]&#V&#V&#M!V!#V65#V/#V#V#V8#VC#V#V #V#V1<#Vw$#V#VG#V)##M"V0#V-#VL5#V0#VW@#V #V#V##V#VA#V@#V6#V0#V(#٬":!ံ!s!NM"V-"#V#V]#V"#M!Va!#V,#V+#M!V4#V.'#VTC#M!VH!$V{ $V+$n "Ц"Ԧ$^!!M!Vr5$V$V$V$V$VE$Vg$V$V$V$V\$V~$M!V!$V$VW$Vo!$V$VJ$VX$V$V=$VK$V<$V$V!$V$V$Vm$V#=$V$V<$M!V!$VR$V$V* $VB$V $V$V$V$^!~!$O!N!ॶ!!f!٬"u!!_"Y"S"M"!!!!! !!!f!O!2!!2!:!ံ! "٬:!ံ!!1NkR!NS$Of!M"V7G $VE $VFG $VF $V4 $V8 $Vs' $VZH $VK2 $V'4 $V8 $V- $V2 $V[2 $V2 $VT4 $V)8 $V0 $V $V~2 $V;4 $V8 $V $Vk $VB $Vf4 $V98 $Vm2 $V" $V $V" $V# $V $VC $VG $V)G $p $"p $"W"#! ! !! !p $"W"u!! ! !j%$p $"W"ͷ*$!!p $"W"ͷ/$p $"W""u!! ! !!2!!!p $"W""!u!d!!!2!p $"W""!2!p $"!R!! ! !Dy""p $"!l!! ! !""p $"!9!Ny!! !p $"!!u!! !p $"!p $"!R!! ! !Dy""p $"!!u!! !p $"!p""HP@WP@4$24$4$64$7q4$p""HP@N4$4$4$24$"{"p""HP@7P@"`4$4$24$p $"lp $"p""W"$j! p $"~p $ 7$Ǽ<$گA$ͷF$ˌK$P$߃U$QZ$k_$8d$i$fn$Ks$x$f}$$$Y$$q$q$$M!VF$VF$VG$M!V]5$V$V$V$V$V%$V$&$V'$V($Vc)$Vr)$V+$Vv.$V/$V5$Vy6$V8$V 9$V>$V B$VH$V!I$VI$VJ$VJK$V`M$VM$VJ$V$V $V$V$V$V$V$V$V$Vw3$V!$VV$V$V$VoA$V?$VmC$VC$Vz($V($V2$V$V$$VG$Vu$V($V*$Vs$V$V\ $VG$V $V$V$V7$V=$V$V$V$V)0$V\*$VP#$VG$V $V~7$V#$V$V3$VE$V'D$V 5$V8$V9$V$VL$VA$V!A$V <$V`$V $V $V$V)$V0$V$V$V$V$V$V^($V1$V<$V?$V $V $V$Vs$VL$V $V$V$V$V$V' $V'$V#$V6$VH$V$C$V@7$V1$V5$VH$VEL$V#$V$VR$$V7$V3$Ve$V!$V$V$V $Vr$V $V$V$Vb$Vh$V$V$Vt $V_$V $V$V$VO$VU$V"$V9$V,$V9$VR=$V_$VG>$V@H$V;$V0$V-$V4-$VQ$V$V>$V=$VE$V~E$Vb0$V0$V$V$V%$V|$V$V$V$V,$V&$V3&$Vm>$V<$VF$Vw@$V;$V$Vw$Ve9$V/9$V3$V<($V$VB$V.$Vz"$V-$V9$V$VB$VK$Vr$VCA$V :$VL$VaL$VW,$V,$V+$V%.$VlD$VE$V)$VN.$VD$VF$V>)$V$VH$VHI$V6$VK$V $$VB$VwJ$V-$V=$VG<$V'$V $V)$V$V7$V($V\?$Vu4$VF8$V'$V? $V3$V7$VB$V6$V$V$V>$M!V5$V3$V!$Vm$V$V$V.$V $V2($VF$V-:$V$V#$VS0$V0$Vt+$VA$VZ$VA$V$V($V$VY$V $V $V$V"$V)$V$V$V$V3$V2$Vm@$V?$V;$V2$VB$VC$V($VC$VC$VC"$V#$VM$VN$V*O$ViP$VJe$V{$V{$V~$V〯$V$V$Vn$VF$Vq$Vώ$V$V钯$V$Vn$Vꫯ$Vҷ$Vٷ$V䷯$V$V$V4$V*$V$V$Vl $VW$V $V$V$VG$VM$V$V$V$VB0$Vt*$Vc#$VG$V $V7$V#$V $V3$V-E$V9D$V5$V8$V9$V$V4L$VA$V6A$V#<$Vr$V $V $V$V;$VB$V$V$V$V$V$V1$V<$V?$V $V$V$V$V]$V$V$V$V$V*$V8 $V8$V $$V6$VI$V8C$VR7$V1$V5$V'H$VWL$V#$V$$Vd$$V7$V3$V{$V=$V"$V9$V,$V9$Ve=$Vt$V^>$VQH$V;$V0$V)-$VG-$Vd$V$V/>$V=$VE$VE$V|0$V0$V$V1$V9$V$V$V$V$V>$V&$VE&$V>$V<$VF$V@$V;$V$V$V9$VN9$V)3$VQ($V$VB$V.$V"$V-$V9$V$VB$VL$V$V]A$V:$VL$VxL$Vm,$V7,$V,$V8.$VD$VF$V*)$Va.$VD$V'F$VP)$V$VH$V_I$V7$VK$VC$$VC$VJ$V-$V=$V]<$V'$V $V)$V$V37$V($Vv?$V4$V`8$V($V[ $V4$V7$VB$V6$M"V!$V`D$VD$V.$VC.$VE$VF$V)$V4)$Vx/$V?$V$V$Vl.$VD$V1F$VZ)$j$m$=e$i"M!VI$V.$VWE$V6=$VI$Vn#$V\J$V$$V?$V-$Vd6$V`$V@@$UU@4$24$7q4$M!V+!$V73$V??$VB$M!V$VK$VL$V/K$VL$VC$VD$VJ$M!Vb$V$V$VYK$VoM$V)$VV$VfG$V)$V*$Vd:$V:$V8$V4$VD$VD$V ;$V+;$VJ$9!e!o$!R!9$p!_$p"$"Ӻ""" """""p"$"Ӻ"""/e"Dj"ͮ"r"""""p"$"Ӻ"""$${${$b$8$p"$"Ӻ""""b"""""p"".j">j"p"$"Ӻ"""!/e"e"N""""p" $[O$_% %%%M!V_%V'%V %!٬"!g!e"t{"_%NM!V5"%VA"%V"%VE"%V"%VnE"% ٺ O f '% %O1%M6%߯;%@%"%6E%V^J%6Q%V%V%u!"a%#/b"/b!/b!/b!/b"/b"/b"/b"/b"/b"P X -q2` * x g1 >~j!}f%u! |!(!{k !k!T !T!*j%!:o%!]pu%!ppz%!c% $"c% X"gQ%"Q%"0% Z#| d#<|% #|h$P%%%%<&%&* p% %&% u% V% A%" %% k%& %' %( ߸%( .%* +%+ &. ˼&0 P&4 <%8 a&9,'. &= %@F(0%AT('&AL)jS5&C)tF)ҫC&G)ǫJ&HX*O J*3bJd+4R&K+WjY&L+gN(-НR&Ol-HUf%P.%_&PL.oi&Q0/%UI/*UT/q&U/Oqw&U/[q}&U/&V/*V/0%V/&V/ʨ&V0*&W0بX@4rX4mX4mX4{kY4kY4|Z4|Z5A[5L[85&\6&\6&\6&\D7x]7QQ]7Q&^8%&_= Q&_= Q&` >Ra,>rb[>*bd>tb>>1d>>d>'1e>'e>1f>f>*&g>oj>~j>Ňk?ԇk?;l?Xl!?m)?m2?Ĵn:?ִnC?oK?oT?Tp\?Tpe?1qm?qv?ir~?ir?Ys?ls?t?Ðt?ǧu?u?0v?Dv?w?w?{x?x?y?ԍy?iz@iz@1{@{(@&|0@&|9@߻u}A@&}J@7&~R@N&~[@vuc@&l@nt@n}@l@l@|@}@@@3@J@K@g@@@ш@@"{&@@{&A& A&A&A9&'AW&/Ar&8A*=BoEBoNBWVBc_B&gB&pB*B\&Bn'Bp1BpBd1BdBmBmBek1BpkB1B$BX&Br&Cɤ&C&CFCN(C0C9Cg1AC.gJCf1RCf[CcC׋lC'tC#'}C*C*'lF?p1tFNp}FFFg1F.gFF׋Fd1FdFe1FeF91FAFo'F"'F&F&&GF GNG|1G|'Gj/Gj8Gc1@GoIG 1QG ZGbGkG!sG1|G@1GNG'G#'GG GGGyGzGfGg''GLb G_bG1GHҌ1HHlHl&Htd1.Hd7H+c1?H?cHH1PHYHV1aHfjH*tH*,'9MWAMcJMلRM[McMlM3'tM9'}MlMlM MMMM*MlMlMeMuM*M6d@'MAdF'NM'NS'NFcNNZ'"Ng1*N.g3Nf;NfDNLN׋XN*a'"OQ4OQ&TOPn'EQ6dx'MQAd~'VQ*pQ>~Q6dx'QAd~'Q'Q$'Q*'Q遟'QS6dx'YSAd~'bS&jS&sSu{S$&S*'Sā%U6dx'UAd~'U&U&UiU$'U*'dV؁%Wp'W*WnW nX m X 3SXj~8X !yX ?p'X@1XNX'X#'Xb'Y'dYoY*Y 3SY ?p'Y mY!Y1Y !yZo Zb'#Z*7Z?Z HZ mOZ 3S`Z !yZ ?p'ZVuZf&Z&Z&[e' [e([b'[\ P\oh\*\\ \ m\ 3S\ !y] ?p']e']e(]&]&^i^'^Ld( ^`d ()^Vc1^cZ'<^b' _l_ _o_*` m` 3S` !y}` ?p'`Ld(``d (`Vc`cZ'`b'`o`*` 3S` ?p'` maa (a !yeacmaZ'vayc ~azZ' afag''aLb a_ba*aoab'b mb 3Sb !yc ?p'cccb'@coXc*lc(tc(}c mc 3Sc !ydP~&d ?p')dM'1dS':dd@'BddF'Kdg1Sd.g\ddd׋mdFcudNZ'db'Deo \en' e*"e m"e 3S"e !y"?f ?p'"Bf1"Jf"Sf 1#[f #dfj$lfj$xfb'%fo(f*(#gi(+g'(4gVu)nX(@n*@n,U&@n:Ub(@n*AnekAnpkAniBoiB o1CoCoe&D#o|&D,ouE4o&E@oo&F~o*Fo 3SFo ?p'Fo mFo !yFolFolFotd1GodGo+c1Ho?cHooIpb'Ip*LpZLTq h(Mq2{(Tr(Zdsj(^sYl(bTt(ct=(dt*etz(eun e uneu͂ fuڂf$ub1g,ubg8u*huPi$vm(itvy%kv/(lw(mx~~(pxS(q0yS(rdyS(syT(tyO(uzi(v3z(w?z%w|z%w{P%w}0%w}rg(w}*x~P(yt~yz~M{~N|%z1}+0%}D)} O% Nj Al ) ) (% %) ) k% ) _ ) #%) % ܳg )) 1) 7% F%) S<) ~<) rA) ~A) A) A) *A) A) jG) IG) ֽP) W) _) (% f) 2p) tx)h}) [)5I1)Pi/)pG) ) /%) Qf%K)ԁKq) d) ) % % % @i) &i) ޘ%) h) Л) i) Ҝ f% f% ˘) ) JN) % Zi* ֞* !* * N!* G* * z(* z(* (* z(* e% l1* q6* T% i ?* dTD* 0% VxK* f% & ø% % 7z(* jxT* q% 3 R\* u T B ,b* \Nh* si* Jo* Б*! Nu*% }*' z*) z*, */ {*2 Su*5 m*7 ۸9 e%: *; C*> t%? R*? 7%B q*C e*H uJ rK f%L `h*L Ù*N *S e%U r*V z*X c*[ 0h*] d*_ q*c q+g r+k +p 5%s '+t 5+x @+| K+ pS+ 8oi+ |r+ .( r+ |+ & :* |+ & &* :+ Nz(* +k+ |+ + `|+ `& gz.( >k+ |+ {h+ ڙ+ & c+ Hh+ d+ q q+ T!* %)04B+`O&+|"+:+0H+Ђs-+a-+<+t++ =* ?u + f fu Tn+ + >$ |- ˥> vu& I \ vj o| # & ( \,) +ԃ*%. e / e5+3 e 7 eK+; rR ? rR5+C rR G rRK+K O e W M Z Qe ] ݅ e n q reu *+v -x yc*z h*| c*~ I-6?* e% R I-06- P#- .- c+ h+ c+ Pu& (( , e 寨, R, \* %) Ŷ* ;% 5- ;G- nP- q\- c- m- m- u- cm- ~- 闆- P~- b~- J~- t-Xt- [-t- % s- s- s- i- Ȼ- m- m- kn- m- a% y\* O% - .\* !* ʩ% Zt- Zt- Zt- Zt. @t- * h. h\* u. . #. Қ Ě% f V3 ) f% f*. ٣/. o4. r t :. W@. WJ. J. m1* Ź) h% 8% % % R >s% kf% P. W. }^. }h. 0R!* % 5}* /J((hl* o. R}1*" v.$ ޹)% ' .n1*( HR!** %+ t, Qs%- ~}.- .. ٟ.0 1.2 }.4 2.5 .7 m.9 r; r< .= ~T.? ((A %C Zm)D .F V%H N%I ~%J rK RL h%M &s%N r%N *O .%P .Q %T JT%U ح.-V ((Y (([ :%] ((^ s%` .a O%d Of%e f%eԄ$.etB.f/.g(.hDVG.i`/.j|.k S)l Q*m %n ;%n Uf)n 0)۪M0)****$k&,k0-k/0*1$k3k/4k/70%8*808 09*:$t: fo,:1q{y{y{y{y{y{y{y{y{y{yNxNxNx *2/mOP %|bOl|bG~\|b|b|b|b'|b1O:@|b*`P c Pgslgsl{yxǼxǼ 2JBJ?AP{y{y!{y{y{y{y{yWu{y{ynūw{{y{y{y^~$O{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y{y }(euū {y{y{yad{{y{y{yadNx{y{y{yadNx{y{y{yїї{yї{y{y{y{yї{y{y{y{y{y{yї{y{yї{y{y{y{y{yї{yї{y{y{y{y{y{yї {y{y{yї{y{y{yїNxNxw{2O|b|b~pTT{yp{y{y{y{y{y{y{y{y{yї2jƮAgrbƮ~KMAgrb2j2jL}{y{y{yb-mF|bR${y{y{y{y{y{y{ykSNN Ft{ l )jt{ n n {y n {y _N_NN#UN#U -m j KMMKMM3 KKKK -m2: j N )j)j )jh)j H n )j UU FS b y 2 : -r7ހ ʷ O M[{y ʷ :[{y -r D nN )j FS b y P 2 : S -m fc n H f٬:f-rh^~$ONH6 6:-rM-rh-r^~$O-rh1-rh1-r٬:-r1-r]e-r]e-r]e-r]e-r]e;l8 i2 ihh fihh fih:wKMhh٬1hh:wKMhh^~$ON-r-rM-rh-r^~$O-r-rh1 Fpϓ PKKKKKK٬٬٬ȬM ٬u ٬4٬^~$O4٬^~$ON٬^~$O٬^~$ONɒ_YSM٬ɒ_YSMu ٬u i hh f P]e P]e P]e P]e P]e P]e P]e P]ej Pլ P PȬ j؀_YSM1j؀_YS Mh fi ffhfǼfMfhf^~$O PPlf P]e P]ef PPflfhf{ǼfMfhf^~$Ofuf{ P]ef P]e P]e ͷ |7ppp7ppp߇̳̳̳̳NNNNNpup|KujǼ j n Ǽ nh 22222 2RNi:fUU0lKHHuRl69 2222SU }40l SU ? ?? u } RRR } OO-O-O-O 2O-OOO22OOOOOOO-O4OOO-OO-N n{ Hq H q PPCO{hlCO{h Pn o P٬n o+SR fq+SR _zUU 6 ~ Œї{y{y{y{y{y{y{y{y{yNxuɺ{y{yE(eJJ_EE(euu_EE(e|bl|bl_EE(egslgsl_Eзvovovo1qзззззǼзз2u|blE(e{{_EE(eEnEn_EE(eN jN j_EE(eNӳNӳ_EE(eNenNen_EE(ezz_E{y{yE(euu_EE(eWW_Eззvo !MMMMMMM M!!M""M''M/:M;DEF ***!* 1*9*A*I*Q*Y*a*i*q*y******* *i*&q*tfo,*3**9a*y*@**G*A*hUWXU[*r|r|gg>~AKojy4*l*{**%*N,,%^,,@!CY'Y"9qK19M1YO@^{NI.SQYQbQڶgh{lwxjsDA*AbA-o*Abp1YTðfb\js\\Di5I:cyAG rڼX*^*yUq1+1*!j!j*g1ίd*l*dPSlPSt*9lF|*9{9ӵsdsutd61tdr**.I*s;A*kG$kX*PS.*9Li*I$kiznkxi*8*9N*Lf*4sPSt >~*I*IhcIݮ3IZ*99`49@9*Pvyvvo* bbȎ'7yybW }etx*YP*!`)k3m9cIYcڵ#ז!!6!!g!Q!)Ta?f *S 3 ! !+ ! !Y !D !} Ԯ + ) *! 9ui*' r/ YqO> A*H y*ykcgn Wt &uCmv p p 31r cy yk o p * *p W oi R Zy r P p *|E J JSP I*w !r*! ** p pP !* * * !*{y!}}l}.lv4PS4&bAe$,61949,yvIyI(w,P 4y2$v$PS$yv,*$*1II`~R *3IGb1hay<7y1y{1u8C>>? ?@?`?????@@A A@A`AA C@C`CCCCCDDE E@E`EEW3j_4Ak_4}}@~`~~~~~ `3 4!4A4a444555! 5A*5a45?5L5Y5g5q5!{5!5A5aB6B65B6ѓѣ3ғң3) !! ! # '!) + / 3 7 ; ? C I O k m ! !! Z!Z!Z!! 7 EZ!GZ!IZ!q ya!} #a!/a!=a!Ka!Z!!+e!5h!a!c!e gh!! ! !!3 9 A!E!K!Q![ ]!i k!! !!! l! l! p! p! ? A C E . @ efghijk_37^{*5I~(Nflz5R_Mg| 17j{ O T & , 4 V l #4=Dl7?Xqur [ Q8.;cQ R%SLTLpHQ>Q R% :=Kiprxy{~ !"$%&'*.:;01q00 0k0T0>0tp0#|11oq11ߨ1m1k1|1P1!1'1,1>21'21211؇1\11ڴ11T121i1p1ǐ11H111؍1i12161=1R61=1n1l1}11N1k111D{C1C1=C1vC1o11H1rQ1p21d21m1k21V21vC1C1y112g21f21ۋ1W1xp2112g21ۋ1d21e21ü21]1C1y1|21j1s21 21J151R21W111z1ga1cbe12121m1d21Cc2121j21111i1'm111'm11!eo1u1y{12g21f1ۋ1!e1!e1V1!e161V=1!e161V1p1$n1m17S1n~1%y1xp1R2117S1xp1m151%y1Z1m17S1%y1xp1j=161e1Z1m17S1%y1xp1e1611dd1g{1m17S1%y1xp1dd1g{17S1xp1m11%y1{1z{1ga1cbe1m17S1%y1xp1J11m17S1%y1T~1xp1u1do12g21ۋ1y{1m17S1%y1xp121 21j11j=1e17S1xp1m1%y11>U'1k1i12161=17S1xp1m1%y1m1d21Cc21~1ne1e1b2117S1xp1m1%y11k1t1rQ1p1b1b1_`'( ) * + DEFGJKOPQRS!T!U#V#W%X'Y)Z)e+f+g-h-i/j/l1m1n3o3p5q5r7s7t9u9v;w;x=y=z?{?|A}A~CCEEGGIIKKMMOOQQSSUUWWYY[[]]__aacceeggiikkmmooqqssuuwwyy{{}} !#$%&()*+,-./01239:=>?@CDEFGHKLMNOPSUVWX YZ [\]^_defghimno!p#q%r's)t)u+v+w-x-~//135799;;==??AACEGIKKMMOQSUUWYY[[]]__acegiikkmoqsuwwyy{{}} -^_`aD81D:3E>1E@3FD1FF313q{NjJ)06w=\^N~ ( ?R'}[?pGAEuGVIAKMkOQS߸U.W+Y [˼]P_k{hڙcHhdqqT=?uffuTn>|˥vu v o&R!R#R%R')e+M-Qe/݅135re7*9;yc=h?cAIEeGIRKJOPQScUhWcYPu[ ]_eacRegiŶk;m,o;qnsquwy{}cPbJt[sssiȻmmknmayO.ʩZtZtZtZt@thhuҚĚf,f٣ortWWmŹh8R>sk}}0R5} 8J R}޹.nHRtQs!~#%ٟ'1)}+2-/m1r3r57~T9;=Zm?AVCNE~GrIRKhM&sOrQS.UWYJT[ح]_a:ce sgiOkOm}SQ;Uf?@ABCDEFG HIJKLMNOP)Q+R.S.T0U0V0W0X0Y0Z0[0\0]0^0_0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0q0r0s0t0u0v0w0x0y0z0{0|0}0~0000000000000000000000000000000000000000000000000009;;;Jm{|aas+j/1iaiG}yi}aa1a a +9E=++RioSDL_SCANCODE_KP_000SDLK_KP_000SDL_SCANCODE_KP_EQUALSAS400SDLK_KP_EQUALSAS400SDL_SCANCODE_KP_00SDLK_KP_00SDL_PIXELFORMAT_ARGB2101010SDL_PACKEDLAYOUT_2101010SDL_LOG_CATEGORY_RESERVED10SDL_SCANCODE_F10SDLK_F10d__10SDL_SCANCODE_F20SDLK_F20<>c__DisplayClass0_0<>9__11_0b__11_0<>9__121_0<.ctor>b__121_0<>c__DisplayClass1_0b__23_0<>9__43_0b__43_0<>c__DisplayClass14_0<>9__24_0b__24_0<>9__44_0b__44_0<>c__DisplayClass4_0<>c__DisplayClass25_0<>c__DisplayClass26_0<>9__27_0b__27_0<>9__57_0<.ctor>b__57_0<>c__DisplayClass7_0<>9__9_0b__9_0SDL_SCANCODE_0SDLK_0SDL_SCANCODE_KP_0SDLK_KP_0b__0b__0b__0b__0b__0b__0b__0get_Scan0SDL_SCANCODE_F11SDLK_F11get_M11SDL_SYSWM_X11x11SDL_BITMAPORDER_4321SDL_SCANCODE_F21SDLK_F21SDL_PIXELFORMAT_RGBA5551SDL_PIXELFORMAT_BGRA5551SDL_PACKEDLAYOUT_5551SDL_LOG_CATEGORY_RESERVED1SDL_SCANCODE_F1SDLK_F1SDL_SCANCODE_LANG1SDL_SCANCODE_INTERNATIONAL1SDL_SCANCODE_APP1SDL_PIXELTYPE_INDEX1SDL_BUTTON_X1Y1<>9__11_1b__11_1<>9__121_1<.ctor>b__121_1<>9__57_1<.ctor>b__57_1SDL_SCANCODE_1SDLK_1SDL_SCANCODE_KP_1SDLK_KP_15__1<>8__1<>9__1b__1<>u__1Func`1Nullable`1IEnumerable`1IOrderedEnumerable`1ConfiguredTaskAwaitable`1Task`1ObservableCollection`1ReadOnlyCollection`1AsyncTaskMethodBuilder`1EqualityComparer`1TaskAwaiter`1IEnumerator`1HashSet`1List`1data1padding1dwItem1color1x1y1SDL_PACKEDLAYOUT_1010102SDL_SCANCODE_F12SDLK_F12SDL_PIXELFORMAT_YV12d__12SDL_SCANCODE_F22SDLK_F22get_M22SDL_PIXELFORMAT_RGB332SDL_PACKEDLAYOUT_332SDL_PIXELTYPE_PACKED32SDL_PIXELTYPE_ARRAYF32AUDIO_F32AUDIO_S32SDL_PIXELTYPE_ARRAYU32Microsoft.Win32ToInt32SDL_LOG_CATEGORY_RESERVED2SDL_SCANCODE_F2SDLK_F2SDL_SCANCODE_LANG2SDL_SCANCODE_INTERNATIONAL2TGMacro.Core.Helpers.Controller.SDL2SDL_SCANCODE_RETURN2SDLK_RETURN2SDL_SCANCODE_APP2DPI_AWARE_CONTEXT_PER_MONITOR_AWARE_V2SDL_BUTTON_X2SDL_PIXELFORMAT_YUY2<>9__57_2<.ctor>b__57_2SDL_SCANCODE_2SDLK_2SDL_SCANCODE_KP_2SDLK_KP_25__2<>9__2b__2<>s__2<>f__AnonymousType0`2Func`2Action`2Converter`2KeyValuePair`2IDictionary`2data2padding2dwItem2get_WaitFor2set_WaitFor2color2get_SleepAmount2set_SleepAmount2x2y2SDL_SCANCODE_F13SDLK_F13SDL_SCANCODE_F23SDLK_F23SDL_LOG_CATEGORY_RESERVED3SDL_SCANCODE_F3SDLK_F3SDL_SCANCODE_LANG3SDL_SCANCODE_INTERNATIONAL3SDL_SCANCODE_3SDLK_3SDL_SCANCODE_KP_3SDLK_KP_35__3<>s__3Func`3padding3SDL_SCANCODE_F14SDLK_F14SDL_PIXELFORMAT_RGB24SDL_SCANCODE_F24SDLK_F24SDL_PIXELFORMAT_BGR24SDL_BITMAPORDER_1234SDL_PIXELFORMAT_RGBA4444SDL_PIXELFORMAT_BGRA4444SDL_PIXELFORMAT_ARGB4444SDL_PIXELFORMAT_ABGR4444SDL_PACKEDLAYOUT_4444SDL_PIXELFORMAT_RGB444get_ImageBase64set_ImageBase64BitmapToBase64SDL_LOG_CATEGORY_RESERVED4SDL_SCANCODE_F4SDLK_F4SDL_SCANCODE_LANG4SDL_SCANCODE_INTERNATIONAL4SDL_PIXELTYPE_INDEX4SDL_SCANCODE_4SDLK_4SDL_SCANCODE_KP_4SDLK_KP_4padding4SDL_SCANCODE_F15SDLK_F15SDL_PIXELFORMAT_ARGB1555SDL_PIXELFORMAT_ABGR1555SDL_PACKEDLAYOUT_1555SDL_PIXELFORMAT_RGB555SDL_PIXELFORMAT_BGR555SDL_PIXELFORMAT_RGB565SDL_PIXELFORMAT_BGR565SDL_PACKEDLAYOUT_565SDL_LOG_CATEGORY_RESERVED5SDL_SCANCODE_F5SDLK_F5SDL_SCANCODE_LANG5SDL_SCANCODE_INTERNATIONAL5SDL_SCANCODE_5SDLK_5SDL_SCANCODE_KP_5SDLK_KP_5SDL_PIXELTYPE_PACKED16SDL_PIXELTYPE_ARRAYF16SDL_SCANCODE_F16SDLK_F16AUDIO_S16SDL_PIXELTYPE_ARRAYU16AUDIO_U16SDL_LOG_CATEGORY_RESERVED6SDL_SCANCODE_F6SDLK_F6SDL_SCANCODE_LANG6SDL_SCANCODE_INTERNATIONAL6SDL_SCANCODE_6SDLK_6SDL_SCANCODE_KP_6SDLK_KP_6SDL_SCANCODE_F17SDLK_F17SDL_LOG_CATEGORY_RESERVED7SDL_SCANCODE_F7SDLK_F7SDL_SCANCODE_LANG7SDL_SCANCODE_INTERNATIONAL7SDL_SCANCODE_7SDLK_7SDL_SCANCODE_KP_7SDLK_KP_7d__7SDL_SCANCODE_F18SDLK_F18SDL_PIXELFORMAT_RGBA8888SDL_PIXELFORMAT_BGRA8888SDL_PIXELFORMAT_ARGB8888SDL_PIXELFORMAT_ABGR8888SDL_PIXELFORMAT_RGBX8888SDL_PIXELFORMAT_BGRX8888SDL_PACKEDLAYOUT_8888SDL_PIXELFORMAT_RGB888SDL_PIXELFORMAT_BGR888SDL_PIXELTYPE_PACKED8SDL_LOG_CATEGORY_RESERVED8get_UTF8SDL_SCANCODE_F8SDLK_F8SDL_SCANCODE_LANG8SDL_SCANCODE_INTERNATIONAL8AUDIO_S8SDL_PIXELTYPE_ARRAYU8AUDIO_U8SDL_PIXELTYPE_INDEX8SDL_PIXELFORMAT_INDEX8SDL_SCANCODE_8SDLK_8SDL_SCANCODE_KP_8SDLK_KP_8SDL_SCANCODE_F19SDLK_F19<>9SDL_LOG_CATEGORY_RESERVED9SDL_SCANCODE_F9SDLK_F9SDL_SCANCODE_LANG9SDL_SCANCODE_INTERNATIONAL9SDL_SCANCODE_9SDLK_9SDL_SCANCODE_KP_9SDLK_KP_9SDL_PACKEDORDER_RGBASDL_ARRAYORDER_RGBASDL_MapRGBASDL_GetRGBASDL_ISPIXELFORMAT_ALPHASDL_HAPTIC_INERTIASDL_HINT_VIDEO_X11_XINERAMASDL_SCANCODE_COMMASDLK_COMMASDL_SCANCODE_KP_COMMASDLK_KP_COMMASDL_SYSWM_COCOASDL_PACKEDORDER_BGRASDL_ARRAYORDER_BGRASDL_SCANCODE_ASDL_CONTROLLER_BUTTON_ASDL_SCANCODE_KP_ASDLK_KP_Aget_ASDL_SCANCODE_TABSDLK_TABSDL_SCANCODE_KP_TABSDLK_KP_TABSDL_SYSWM_DIRECTFBSDL_PACKEDORDER_ARGBSDL_ARRAYORDER_ARGBSDL_PACKEDORDER_XRGBSDL_ARRAYORDER_RGBSDL_MapRGBSDL_GetRGBSDL_PIXELFORMAT_INDEX1LSBAUDIO_F32LSBAUDIO_S32LSBSDL_PIXELFORMAT_INDEX4LSBAUDIO_S16LSBAUDIO_U16LSBSDL_PIXELFORMAT_INDEX1MSBAUDIO_F32MSBAUDIO_S32MSBSDL_PIXELFORMAT_INDEX4MSBAUDIO_S16MSBAUDIO_U16MSBSDL_SCANCODE_BSDL_CONTROLLER_BUTTON_BSDL_SCANCODE_KP_BSDLK_KP_Bget_Bset_BSDL_DEFINE_PIXELFOURCCSDL_FOURCCSDL_ISPIXELFORMAT_FOURCChSrcDCReleaseDChDCGetDCSDL_TEXTUREACCESS_STATICSDL_INIT_HAPTICSDL_RENDERER_PRESENTVSYNCSDL_HINT_RENDER_VSYNCSDL_PREALLOCSDL_SCANCODE_CSDL_SCANCODE_KP_CSDLK_KP_CSDL_SCANCODE_KP_MEMADDSDLK_KP_MEMADDSDL_BLENDMODE_ADDSDL_WINDOW_INPUT_GRABBEDSDL_CONTROLLERDEVICEADDEDSDL_JOYDEVICEADDEDSDL_WINDOWEVENT_SIZE_CHANGEDSDL_HINT_XINPUT_ENABLEDSDL_HINT_VIDEO_HIGHDPI_DISABLEDSDL_HINT_IDLE_TIMER_DISABLEDSDL_AUDIO_ISUNSIGNEDSDL_AUDIO_ISSIGNEDSDL_AUDIO_MASK_SIGNEDSDL_WINDOWEVENT_FOCUS_GAINEDSDL_WINDOWPOS_ISUNDEFINEDSDL_WINDOWPOS_UNDEFINEDSDL_CONTROLLERDEVICEREMAPPEDSDL_AUDIO_STOPPEDSDL_WINDOWPOS_ISCENTEREDSDL_WINDOWPOS_CENTEREDSDL_HAT_CENTEREDSDL_WINDOWEVENT_RESTOREDSDL_RELEASEDSDL_WINDOWEVENT_EXPOSEDSDL_TICKS_PASSEDSDL_PRESSEDSDL_AUDIO_PAUSEDSDL_RENDERER_ACCELERATEDLLKHF_INJECTEDSDL_MESSAGEBOX_COLOR_BUTTON_SELECTEDSDL_CONTROLLERDEVICEREMOVEDSDL_JOYDEVICEREMOVEDSDL_WINDOWEVENT_MOVEDKMOD_RESERVEDSDL_ISPIXELFORMAT_INDEXEDSDL_WINDOWEVENT_MINIMIZEDSDL_WINDOW_MINIMIZEDSDL_WINDOWEVENT_MAXIMIZEDSDL_WINDOW_MAXIMIZEDSDL_WINDOWEVENT_RESIZEDSDL_TOUCH_MOUSEIDSDL_CONTROLLER_BUTTON_INVALIDSDL_CONTROLLER_AXIS_INVALIDcbGUIDSDL_JoystickGetDeviceGUIDpchGUIDSDL_GameControllerMappingForGUIDSDL_JoystickGetGUIDpszGUIDSDL_JoystickInstanceIDtouchIDSDL_GetWindowFromIDSDL_WindowEventIDSDL_GetWindowIDwindowIDSDL_SYSTEM_CURSOR_HANDSDL_SCANCODE_KP_DBLAMPERSANDSDLK_KP_DBLAMPERSANDSDLK_AMPERSANDSDL_SCANCODE_KP_AMPERSANDSDLK_KP_AMPERSANDSDL_BLENDMODE_BLENDSDL_SCANCODE_ENDSDLK_ENDSDL_SCANCODE_FINDSDLK_FINDSDL_MESSAGEBOX_COLOR_BUTTON_BACKGROUNDSDL_MESSAGEBOX_COLOR_BACKGROUNDSDL_SCANCODE_PERIODSDLK_PERIODSDL_SCANCODE_KP_PERIODSDLK_KP_PERIODSDL_BLENDMODE_MODSDL_HINT_GRAB_KEYBOARDSDL_SCANCODE_AC_FORWARDSDLK_AC_FORWARDSDL_DOLLARRECORDSDL_SCANCODE_DSDL_SCANCODE_KP_DSDLK_KP_DSDL_SWSURFACESDL_SCANCODE_BACKSPACESDLK_BACKSPACESDL_SCANCODE_KP_BACKSPACESDLK_KP_BACKSPACESDL_SCANCODE_SPACESDLK_SPACESDL_SCANCODE_KP_SPACESDLK_KP_SPACESDL_SCANCODE_KP_LEFTBRACESDLK_KP_LEFTBRACESDL_SCANCODE_KP_RIGHTBRACESDLK_KP_RIGHTBRACESDL_HINT_OVERRIDESDL_CONTROLLER_BUTTON_GUIDESDL_SCANCODE_KP_MEMDIVIDESDLK_KP_MEMDIVIDESDL_SCANCODE_KP_DIVIDESDLK_KP_DIVIDESDL_SCANCODE_TO_KEYCODESDL_HINT_VIDEO_X11_XVIDMODEKMOD_MODESDL_SCANCODE_MODESDLK_MODESDL_DONTFREESDL_HINT_RENDER_DIRECT3D_THREADSAFESDL_AUDIO_ALLOW_CHANNELS_CHANGESDL_AUDIO_ALLOW_FORMAT_CHANGESDL_AUDIO_ALLOW_FREQUENCY_CHANGESDL_AUDIO_ALLOW_ANY_CHANGESDL_SCANCODE_APOSTROPHESDL_ENABLESDL_GL_FRAMEBUFFER_SRGB_CAPABLESDL_DISABLESDL_WINDOW_RESIZABLESDL_BUTTON_MIDDLESDL_SCANCODE_KBDILLUMTOGGLESDLK_KBDILLUMTOGGLESDL_HAPTIC_TRIANGLESDL_DROPFILESDL_SetSurfaceRLEGWL_EXSTYLESDL_SCANCODE_AC_HOMESDLK_AC_HOMESDL_SCANCODE_HOMESDLK_HOMESDL_MIX_MAXVOLUMESDL_HAPTIC_SINEKMOD_NONESDL_BLENDMODE_NONESDL_CONTROLLER_BINDTYPE_NONESDL_TEXTUREMODULATE_NONESDL_FLIP_NONESDL_PACKEDORDER_NONESDL_BITMAPORDER_NONESDL_ARRAYORDER_NONESDL_WINDOWEVENT_NONESDL_PACKEDLAYOUT_NONESDL_SCANCODE_ESCAPESDLK_ESCAPESDL_AUDIO_MASK_DATATYPESDL_PIXELTYPESDL_SYSWM_TYPESDL_RENDERER_SOFTWARESDLK_UNDERSCORESDL_GL_CONTEXT_PROFILE_CORESDL_IGNORESDL_SCANCODE_KP_MEMSTORESDLK_KP_MEMSTORESDL_MULTIGESTURESDL_DOLLARGESTURESDL_RENDERER_TARGETTEXTURESDL_SCANCODE_ALTERASESDLK_ALTERASESDL_FALSESDL_LOG_PRIORITY_VERBOSESDL_WINDOWEVENT_CLOSESDL_HAPTIC_PAUSESDL_SCANCODE_PAUSESDLK_PAUSESDL_SYSTEM_CURSOR_SIZENWSESDL_CLIPBOARDUPDATESDL_SCANCODE_DELETESDLK_DELETESDLK_BACKQUOTESDLK_QUOTESDL_SCANCODE_PASTESDLK_PASTESDL_SCANCODE_EXECUTESDLK_EXECUTESDL_INIT_NOPARACHUTESDL_SCANCODE_AUDIOMUTESDLK_AUDIOMUTESDL_SCANCODE_MUTESDLK_MUTESDL_TRUESDL_WINDOWEVENT_LEAVESDL_SCANCODE_GRAVESDL_SYSTEM_CURSOR_SIZEWESDL_AUDIO_MASK_BITSIZESDL_AUDIO_BITSIZESDL_GL_ALPHA_SIZESDL_GL_ACCUM_ALPHA_SIZESDL_GL_RED_SIZESDL_GL_ACCUM_RED_SIZESDL_GL_BLUE_SIZESDL_GL_ACCUM_BLUE_SIZESDL_GL_DEPTH_SIZESDL_GL_STENCIL_SIZESDL_GL_GREEN_SIZESDL_GL_ACCUM_GREEN_SIZESDL_GL_BUFFER_SIZESDL_TEXTEDITINGEVENT_TEXT_SIZESDL_TEXTINPUTEVENT_TEXT_SIZESDL_SCANCODE_ESDL_SCANCODE_KP_ESDLK_KP_ESDL_SCANCODE_FSDL_SCANCODE_KP_FSDLK_KP_FSDL_PIXELFLAGSDL_GL_CONTEXT_FORWARD_COMPATIBLE_FLAGSDL_GL_CONTEXT_DEBUG_FLAGSDL_GL_CONTEXT_RESET_ISOLATION_FLAGSDL_GL_CONTEXT_ROBUST_ACCESS_FLAGSDL_HINT_GAMECONTROLLERCONFIGSDL_INIT_EVERYTHINGSDL_GL_RETAINED_BACKINGSDL_TEXTUREACCESS_STREAMINGSDL_MESSAGEBOX_WARNINGSDL_HAPTIC_SPRINGSDL_TEXTEDITINGSDL_AUDIO_PLAYINGSDL_LOG_PRIORITY_DEBUGSDL_SCANCODE_Gget_Gset_GSDL_SCANCODE_AC_SEARCHSDLK_AC_SEARCHSDL_SCANCODE_DISPLAYSWITCHSDLK_DISPLAYSWITCHSDL_SCANCODE_NONUSHASHSDLK_HASHSDL_SCANCODE_KP_HASHSDLK_KP_HASHSDL_SCANCODE_NONUSBACKSLASHSDL_SCANCODE_BACKSLASHSDLK_BACKSLASHSDL_SCANCODE_SLASHSDLK_SLASHSDL_SCANCODE_AC_REFRESHSDLK_AC_REFRESHSDL_SCANCODE_HSDL_WINDOW_ALLOW_HIGHDPIKMOD_LGUISDL_SCANCODE_LGUISDLK_LGUIKMOD_RGUISDL_SCANCODE_RGUISDLK_RGUIKMOD_GUISDL_SCANCODE_ISDL_SCANCODE_JSDL_SCANCODE_AC_BACKSDLK_AC_BACKSDL_CONTROLLER_BUTTON_BACKSDL_HINT_CTRL_CLICK_EMULATE_RIGHT_CLICKSDL_CONTROLLER_BUTTON_LEFTSTICKSDL_CONTROLLER_BUTTON_RIGHTSTICKSDL_HINT_ACCELEROMETER_AS_JOYSTICKSDL_INIT_JOYSTICKSDL_SCANCODE_SCROLLLOCKSDLK_SCROLLLOCKSDL_SCANCODE_CAPSLOCKSDLK_CAPSLOCKSDL_MUSTLOCKSDL_BUTTON_X1MASKSDL_BUTTON_X2MASKSDL_BUTTON_LMASKSDL_BUTTON_MMASKSDL_BUTTON_RMASKSDL_WINDOWPOS_UNDEFINED_MASKSDL_WINDOWPOS_CENTERED_MASKSDLK_SCANCODE_MASKSDL_GL_CONTEXT_PROFILE_MASKSDLK_ASTERISKSDL_SCANCODE_KSDL_HAPTIC_SPHERICALSDL_LOG_PRIORITY_CRITICALSDL_TEXTUREMODULATE_VERTICALSDL_FLIP_VERTICALSDL_SCANCODE_KP_HEXADECIMALSDLK_KP_HEXADECIMALSDL_SCANCODE_KP_DECIMALSDLK_KP_DECIMALSDL_HINT_NORMALSDL_SCANCODE_KP_OCTALSDLK_KP_OCTALSDL_TEXTUREMODULATE_HORIZONTALSDL_FLIP_HORIZONTALSDL_GL_ACCELERATED_VISUALSDLK_QUOTEDBLSDLSDL_RLEACCELSDL_SCANCODE_CANCELSDLK_CANCELSDL_MOUSEWHEELSDL_SCANCODE_CRSELSDLK_CRSELSDL_SCANCODE_EXSELSDLK_EXSELSDL_PATCHLEVELSDL_BYTESPERPIXELSDL_BITSPERPIXELSDL_GL_CONTEXT_EGLSDL_WINDOW_OPENGLSDL_SCANCODE_MAILSDLK_MAILSDL_SCANCODE_KP_MEMRECALLSDLK_KP_MEMRECALLSDL_SYSTEM_CURSOR_SIZEALLWH_KEYBOARD_LLKMOD_LCTRLSDL_SCANCODE_LCTRLSDLK_LCTRLKMOD_RCTRLSDL_SCANCODE_RCTRLSDLK_RCTRLKMOD_CTRLSDL_SCANCODE_LSDL_SYSTEM_CURSOR_IBEAMSDL_SCANCODE_KP_EXCLAMSDLK_KP_EXCLAMSDL_GetSystemRAMSDL_LOG_CATEGORY_SYSTEMAmcToTGMSDLK_EXCLAIMSDL_HAPTIC_CUSTOMSDL_LOG_CATEGORY_CUSTOMSDL_PIXELTYPE_ENUMSDL_PIXELORDER_ENUMSDL_PACKEDLAYOUT_ENUMSDL_VERSIONNUMKMOD_NUMSDL_SCANCODE_MSDL_AUDIO_ISLITTLEENDIANSDL_AUDIO_ISBIGENDIANSDL_AUDIO_MASK_ENDIANSDL_HAPTIC_CARTESIANSDL_WINDOWEVENT_HIDDENSDL_WINDOW_HIDDENSDL_WINDOW_FULLSCREENSDL_SCANCODE_PRINTSCREENSDLK_PRINTSCREENSDLK_LEFTPARENSDL_SCANCODE_KP_LEFTPARENSDLK_KP_LEFTPARENSDLK_RIGHTPARENSDL_SCANCODE_KP_RIGHTPARENSDLK_KP_RIGHTPARENSDL_WINDOW_FOREIGNSDL_SCANCODE_CLEARAGAINSDLK_CLEARAGAINSDL_SCANCODE_AGAINSDLK_AGAINSDL_HAPTIC_GAINSDL_COMPILEDVERSIONSDL_VERSIONSDL_MAJOR_VERSIONSDL_GL_CONTEXT_MAJOR_VERSIONSDL_MINOR_VERSIONSDL_GL_CONTEXT_MINOR_VERSIONSDL_SCANCODE_APPLICATIONSDLK_APPLICATIONSDL_LOG_CATEGORY_APPLICATIONSDL_MESSAGEBOX_INFORMATIONSDL_HINT_FRAMEBUFFER_ACCELERATIONSDL_HAPTIC_FRICTIONSDL_MOUSEMOTIONSDL_JOYBALLMOTIONSDL_FINGERMOTIONSDL_CONTROLLERAXISMOTIONSDL_JOYAXISMOTIONSDL_JOYHATMOTIONSDLK_QUESTIONSDL_HINT_TIMER_RESOLUTIONSDL_SCANCODE_SEMICOLONSDLK_SEMICOLONSDLK_COLONSDL_SCANCODE_KP_COLONSDLK_KP_COLONSDL_CONTROLLER_BINDTYPE_BUTTONSDL_BUTTONSDL_LOG_PRIORITY_WARNSDL_SCANCODE_RETURNSDLK_RETURNSDL_SCANCODE_PAGEDOWNSDLK_PAGEDOWNSDL_SCANCODE_VOLUMEDOWNSDLK_VOLUMEDOWNSDL_HAPTIC_SAWTOOTHDOWNSDL_SCANCODE_KBDILLUMDOWNSDLK_KBDILLUMDOWNSDL_MOUSEBUTTONDOWNSDL_CONTROLLERBUTTONDOWNSDL_JOYBUTTONDOWNSDL_FINGERDOWNSDL_SCANCODE_BRIGHTNESSDOWNSDLK_BRIGHTNESSDOWNSDL_HAT_LEFTDOWNSDL_HAT_RIGHTDOWNWM_SYSKEYDOWNSDL_KEYDOWNWM_KEYDOWNSDL_CONTROLLER_BUTTON_DPAD_DOWNSDL_SCANCODE_DOWNSDLK_DOWNSDL_HAT_DOWNSDL_WINDOWEVENT_SHOWNSDL_WINDOW_SHOWNSDL_SCANCODE_UNKNOWNSDL_PIXELTYPE_UNKNOWNSDLK_UNKNOWNSDL_SYSWM_UNKNOWNSDL_PIXELFORMAT_UNKNOWNSDL_SCANCODE_NSDL_SCANCODE_UNDOSDLK_UNDOSDL_INIT_VIDEOSDL_LOG_CATEGORY_VIDEOSDL_GL_STEREOSDL_LOG_PRIORITY_INFOSystem.IOSDL_INIT_AUDIOSDL_LOG_CATEGORY_AUDIOSDL_SYSTEM_CURSOR_NOSDL_SCANCODE_OSDL_SCANCODE_SLEEPSDLK_SLEEPSDL_SCANCODE_HELPSDLK_HELPSDL_LoadBMPSDL_SaveBMPSDL_WINDOW_FULLSCREEN_DESKTOPSDL_SCANCODE_AUDIOSTOPSDLK_AUDIOSTOPSDL_SCANCODE_AC_STOPSDLK_AC_STOPSDL_SCANCODE_STOPSDLK_STOPSDL_HINT_MOUSE_RELATIVE_MODE_WARPSDL_SCANCODE_PAGEUPSDLK_PAGEUPSDL_SCANCODE_VOLUMEUPSDLK_VOLUMEUPSDL_HAPTIC_SAWTOOTHUPSDL_SCANCODE_KBDILLUMUPSDLK_KBDILLUMUPSDL_MOUSEBUTTONUPSDL_CONTROLLERBUTTONUPSDL_JOYBUTTONUPSDL_FINGERUPSDL_SCANCODE_BRIGHTNESSUPSDLK_BRIGHTNESSUPSDL_HAT_LEFTUPSDL_HAT_RIGHTUPWM_SYSKEYUPSDL_KEYUPWM_KEYUPSDL_CONTROLLER_BUTTON_DPAD_UPSDL_SCANCODE_UPSDLK_UPSDL_HAT_UPSDL_SCANCODE_PSDL_SCANCODE_SYSREQSDLK_SYSREQSDL_SCANCODE_QSDL_SCANCODE_KP_DBLVERTICALBARSDLK_KP_DBLVERTICALBARSDL_SCANCODE_KP_VERTICALBARSDLK_KP_VERTICALBARSDL_SCANCODE_NUMLOCKCLEARSDLK_NUMLOCKCLEARSDL_SCANCODE_KP_MEMCLEARSDLK_KP_MEMCLEARSDL_SCANCODE_CLEARSDLK_CLEARSDL_SCANCODE_KP_CLEARSDLK_KP_CLEARSDLK_DOLLARSDL_HAPTIC_POLARSDL_HINT_VIDEO_X11_XRANDRSDL_CONTROLLER_BUTTON_LEFTSHOULDERSDL_CONTROLLER_BUTTON_RIGHTSHOULDERSDL_LOG_CATEGORY_RENDERSDL_MESSAGEBOX_COLOR_BUTTON_BORDERSDL_PIXELORDERSDL_GL_DOUBLEBUFFERSDL_CONTROLLER_BUTTON_LEFTTRIGGERSDL_CONTROLLER_BUTTON_RIGHTTRIGGERSDL_HINT_VIDEO_WIN_D3DCOMPILERSDL_INIT_GAMECONTROLLERSDL_INIT_TIMERSDL_HAPTIC_DAMPERSDL_SCANCODE_OPERSDLK_OPERSDLK_GREATERSDL_SCANCODE_KP_GREATERSDLK_KP_GREATERSDL_HAPTIC_AUTOCENTERSDL_SCANCODE_KP_ENTERSDLK_KP_ENTERSDL_WINDOWEVENT_ENTERSDL_SCANCODE_COMPUTERSDLK_COMPUTERSDL_HINT_VIDEO_ALLOW_SCREENSAVERSDL_HINT_RENDER_DRIVERSDL_SCANCODE_POWERSDLK_POWERSDL_SCANCODE_KP_POWERSDLK_KP_POWERSDL_PACKEDORDER_ABGRSDL_ARRAYORDER_ABGRSDL_PACKEDORDER_XBGRSDL_ARRAYORDER_BGRSDL_SYSTEM_CURSOR_CROSSHAIRSDL_SCANCODE_PRIORSDLK_PRIORSDL_MESSAGEBOX_ERRORSDL_LOG_CATEGORY_ERRORSDL_LOG_PRIORITY_ERRORSDL_SCANCODE_CALCULATORSDLK_CALCULATORSDL_SCANCODE_DECIMALSEPARATORSDLK_DECIMALSEPARATORSDL_SCANCODE_THOUSANDSSEPARATORSDLK_THOUSANDSSEPARATORSDL_SCANCODE_SEPARATORSDLK_SEPARATORSDL_SCANCODE_KP_XORSDLK_KP_XORSDL_SCANCODE_Rget_Rset_RSDL_HINT_VIDEO_MAC_FULLSCREEN_SPACESSDL_NUM_SCANCODESSDL_NUM_LOG_PRIORITIESSDL_GL_MULTISAMPLESAMPLESSDL_GL_CONTEXT_PROFILE_ESSDL_GL_CONTEXT_FLAGSSDL_CONTROLLER_BINDTYPE_AXISSDL_SCANCODE_AC_BOOKMARKSSDLK_AC_BOOKMARKSSDL_SCANCODE_EQUALSSDLK_EQUALSSDL_SCANCODE_KP_EQUALSSDLK_KP_EQUALSSDL_SYSTEM_CURSOR_SIZENSSDL_HINT_ORIENTATIONSKMOD_CAPSSDL_HINT_RENDER_OPENGL_SHADERSSDL_GL_MULTISAMPLEBUFFERSSDL_NUM_SYSTEM_CURSORSSDL_WINDOW_BORDERLESSSDLK_LESSSDL_SCANCODE_KP_LESSSDLK_KP_LESSSDL_HINT_VIDEO_MINIMIZE_ON_FOCUS_LOSSSDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTSSDL_WINDOW_MOUSE_FOCUSSDL_WINDOW_INPUT_FOCUSSDLK_PLUSSDL_SCANCODE_KP_PLUSSDLK_KP_PLUSSDL_SCANCODE_KP_PLUSMINUSSDLK_KP_PLUSMINUSSDL_SCANCODE_MINUSSDLK_MINUSSDL_SCANCODE_KP_MINUSSDLK_KP_MINUSSDL_HAPTIC_STATUSSDL_SYSWM_WINDOWSAUDIO_F32SYSAUDIO_S32SYSAUDIO_S16SYSAUDIO_U16SYSSDL_SCANCODE_SSDL_CONTROLLER_BINDTYPE_HATSDL_DEFINE_PIXELFORMATSDL_HINT_VIDEO_WINDOW_SHARE_PIXEL_FORMATSDL_AUDIO_ISFLOATSDLK_ATSDL_SCANCODE_KP_ATSDLK_KP_ATSDL_SCANCODE_KP_MEMSUBTRACTSDLK_KP_MEMSUBTRACTSDL_SCANCODE_EJECTSDLK_EJECTSDL_SCANCODE_MEDIASELECTSDLK_MEDIASELECTSDL_SCANCODE_SELECTSDLK_SELECTKBDLLHOOKSTRUCTSDL_TEXTUREACCESS_TARGETSDL_SCANCODE_LEFTBRACKETSDLK_LEFTBRACKETSDL_SCANCODE_RIGHTBRACKETSDLK_RIGHTBRACKETSDLK_CARETSDL_RENDER_TARGETS_RESETSDL_CONTROLLER_AXIS_TRIGGERLEFTSDL_CONTROLLER_BUTTON_DPAD_LEFTSDL_SCANCODE_LEFTSDLK_LEFTSDL_BUTTON_LEFTSDL_HAT_LEFTKMOD_LSHIFTSDL_SCANCODE_LSHIFTSDLK_LSHIFTKMOD_RSHIFTSDL_SCANCODE_RSHIFTSDLK_RSHIFTKMOD_SHIFTSDL_CONTROLLER_AXIS_TRIGGERRIGHTSDL_HAPTIC_LEFTRIGHTSDL_CONTROLLER_BUTTON_DPAD_RIGHTSDL_SCANCODE_RIGHTSDLK_RIGHTSDL_BUTTON_RIGHTSDL_HAT_RIGHTSDL_SYSTEM_CURSOR_WAITSDL_SYSWM_UIKITSDL_SCANCODE_CURRENCYSUBUNITSDLK_CURRENCYSUBUNITSDL_SCANCODE_CURRENCYUNITSDLK_CURRENCYUNITSDL_QUITKMOD_LALTSDL_SCANCODE_LALTSDLK_LALTKMOD_RALTSDL_SCANCODE_RALTSDLK_RALTKMOD_ALTSDL_HINT_DEFAULTSDL_MESSAGEBOX_BUTTON_ESCAPEKEY_DEFAULTSDL_MESSAGEBOX_BUTTON_RETURNKEY_DEFAULTSDL_HAPTIC_CONSTANTSDLK_PERCENTSDL_SCANCODE_KP_PERCENTSDLK_KP_PERCENTSDL_ADDEVENTSDL_PEEKEVENTSDL_SYSWMEVENTSDL_USEREVENTSDL_GETEVENTSDL_LASTEVENTSDL_FIRSTEVENTSDL_WINDOWEVENTSDL_AUDIO_ISINTSDL_CONTROLLER_BUTTON_STARTSDL_SCANCODE_INSERTSDLK_INSERTSDL_LOG_CATEGORY_ASSERTSDL_VERSION_ATLEASTSDL_LOG_CATEGORY_TESTSDL_WINDOWEVENT_FOCUS_LOSTSDL_HINT_ALLOW_TOPMOSTSDL_SCANCODE_CUTSDLK_CUTSDL_PIXELLAYOUTSDL_SCANCODE_OUTSDLK_OUTSDL_TEXTINPUTSDL_LOG_CATEGORY_INPUTSDL_SCANCODE_AUDIONEXTSDLK_AUDIONEXTSDL_GL_SHARE_WITH_CURRENT_CONTEXTSDL_MESSAGEBOX_COLOR_TEXTSDL_SCANCODE_TSDL_SCANCODE_MENUSDLK_MENUSDL_PIXELFORMAT_YVYUSDL_SCANCODE_USDL_LoadWAVSDL_FreeWAVSDL_SCANCODE_AUDIOPREVSDLK_AUDIOPREVSDL_PIXELFORMAT_IYUVSDL_SCANCODE_VSDL_LogMessageVWS_EX_TOOLWINDOWSDL_SYSTEM_CURSOR_WAITARROWSDL_SYSTEM_CURSOR_ARROWINTERNAL_SDL_LoadBMP_RWINTERNAL_SDL_SaveBMP_RWINTERNAL_SDL_LoadWAV_RWINTERNAL_SDL_GameControllerAddMappingsFromRWSDL_SYSTEM_CURSOR_SIZENESWSDL_SCANCODE_WWWSDLK_WWWSDL_SCANCODE_WSDL_CONTROLLER_BUTTON_MAXSDL_MESSAGEBOX_COLOR_MAXSDL_CONTROLLER_AXIS_MAXSDL_PACKEDORDER_RGBXSDL_PACKEDORDER_BGRXSDL_CONTROLLER_AXIS_LEFTXSDL_CONTROLLER_AXIS_RIGHTXSDL_SCANCODE_XSDL_CONTROLLER_BUTTON_Xget_XscaleXscreenXSDL_SCANCODE_AUDIOPLAYSDLK_AUDIOPLAYSDL_WINDOWPOS_UNDEFINED_DISPLAYSDL_WINDOWPOS_CENTERED_DISPLAYSDL_SCANCODE_KP_MEMMULTIPLYSDLK_KP_MEMMULTIPLYSDL_SCANCODE_KP_MULTIPLYSDLK_KP_MULTIPLYSDL_SCANCODE_COPYSDLK_COPYSDL_SCANCODE_KP_BINARYSDLK_KP_BINARYSDL_QUERYSDL_SCANCODE_KP_CLEARENTRYSDLK_KP_CLEARENTRYSDL_CONTROLLER_AXIS_LEFTYSDL_CONTROLLER_AXIS_RIGHTYSDL_HINT_RENDER_SCALE_QUALITYSDL_GL_CONTEXT_PROFILE_COMPATIBILITYSDL_HAPTIC_INFINITYSDL_PIXELFORMAT_UYVYSDL_SCANCODE_YSDL_CONTROLLER_BUTTON_Yget_YscaleYscreenYSDL_SCANCODE_Zvalue__SDLK_aalphaSystem.Windows.MediagammacocoaCleanUpManagedDataKeyboardDataMouseDataCleanUpNativeDataINTERNAL_SDL_MessageBoxButtonDataBitmapDataSDL_GetWindowDataSDL_SetWindowDataINTERNAL_SDL_MessageBoxDatapressedKeyDatalock_datauserdatadriverdatamessageboxdatadThetaSDLK_bHideFromAltTabSDL_GetWindowGrabSDL_SetWindowGrabdfbFromArgbmscorlibset_Verb<>cSDLK_chdcSDL_AudioSpecspecSDL_HapticPeriodicperiodicSystem.Collections.GenericSDL_MouseIsHapticSDL_JoystickIsHaptichapticlpEnumFuncGetStringAsyncSDL_mallocLowLevelKeyboardProcEnumWindowsProcprocxSrcySrcfreesrc<b__1>ddwThreadIdgestureIdprogIdtouchIdHookIdfingerIdwEventIdSDLK_dRead_baseWorkThreadTriggerThreadControllerHandlerThreadControllerThreadAddget_OrangeRedgrabbedWaitIfNeededAddDelayIfNeededMarshalNativeToManagedMacroRunStateChangedadd_OnBusyStateChangedremove_OnBusyStateChangedMacroBusyStateChangedadd_EnableStatusChangedremove_EnableStatusChangedadd_OnRunStatusChangedremove_OnRunStatusChangedAppStatusChangedadd_PropertyChangedremove_PropertyChangedOnPropertyChangedINotifyPropertyChangedSDL_JoystickGetAttachedSDL_GameControllerGetAttachedInterlockedSDL_BlitScaledSDL_UpperBlitScaledSDL_LowerBlitScaledSDL_IsScreenSaverEnabledenabledSDL_HapticOpenedSDL_JoystickOpenedobtainedIsDefinedSDL_SetWindowBorderedbordered_triggereddesiredget_IsAutoWaitRequiredget_ElapsedSuccessedIsPressedIsModifierKeyPressedLeaveAllocated_leaveAllocatedSDL_AudioDeviceConnectedadd_ControllerConnectedremove_ControllerConnectedadd_ControllerDisconnectedremove_ControllerDisconnectedAwaitUnsafeOnCompletedget_IsCompletedSDL_HapticRumbleSupportedSDL_GL_ExtensionSupportedSDL_HapticEffectSupportedSDL_RenderTargetSupportedget_IsSavedset_IsSavedOnSourceInitializedget_HideToTrayWhenMinimizedset_HideToTrayWhenMinimizedSynchronizedbuttonidget_ValidGuidset_ValidGuidVerifyGuidguidi__Fieldi__Fieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingFieldk__BackingField<WindowTitle>k__BackingField<MacroName>k__BackingField<GroupName>k__BackingField<Theme>k__BackingField<NextTime>k__BackingField<FileType>k__BackingField<ActionType>k__BackingField<LastActionType>k__BackingField<TriggerType>k__BackingField<SearchAreaSize>k__BackingField<SearchAreaSelectorMaxSize>k__BackingField<MousePositioning>k__BackingField<DoNotShowAdministratorWarning>k__BackingField<IsFirstLaunch>k__BackingField<Stopwatch>k__BackingField<Interval>k__BackingField<DownloadUrl>k__BackingField<DiscordUrl>k__BackingField<IngoreDelayLassThan>k__BackingField<RunAsAdmin>k__BackingField<Version>k__BackingField<AppVersion>k__BackingField<RememberLastWindowLocation>k__BackingField<SearchAreaPosition>k__BackingField<UseCursorPosition>k__BackingField<MainWindowPosition>k__BackingField<MacroEditorWindowPosition>k__BackingField<SettingsWindowPosition>k__BackingField<ImageFoundOption>k__BackingField<ImageNotFoundOption>k__BackingField<Description>k__BackingField<ShowDiscordButton>k__BackingField<Info>k__BackingField<PlayOnOffAudio>k__BackingField<PlayOnOffMacroAudio>k__BackingField<AutoSaveMacro>k__BackingField<KeepActiveMacrosAtTheTop>k__BackingField<WaitFor>k__BackingField<Color>k__BackingField<Error>k__BackingField<DoNotShowOfficialWebsites>k__BackingField<MacroSettings>k__BackingField<Actions>k__BackingField<Pos>k__BackingField<MousePos>k__BackingField<Macros>k__BackingField<KeyModifiers>k__BackingField<RecordKeyModifiers>k__BackingField<EnableKeyModifiers>k__BackingField<ActivationKeyModifiers>k__BackingField<TriggerKeyModifiers>k__BackingField<Parameters>k__BackingField<RecordMouseMovements>k__BackingField<KeyPoints>k__BackingField<IgnoreSelfInputs>k__BackingField<RecordDelays>k__BackingField<RecordKeybordKeys>k__BackingField<RecordMouseKeys>k__BackingField<ControllerTriggerKeys>k__BackingField<ModifierKeys>k__BackingField<InputLimit>k__BackingField<LoopCount>k__BackingField<ScrollAmount>k__BackingField<SleepAmount>k__BackingField<EnableOnStart>k__BackingField<LoadLastMacroOnStart>k__BackingField<EnableControllerSupport>k__BackingField<Text>k__BackingField<NoText>k__BackingField<YesText>k__BackingField<CommentText>k__BackingField<OverlayWindow>k__BackingField<Key>k__BackingField<KeyboardKey>k__BackingField<RecordKey>k__BackingField<EnableKey>k__BackingField<MouseKey>k__BackingField<ActivationKey>k__BackingField<TriggerKey>k__BackingField<SuppressTriggerKey>k__BackingFieldGetFieldFixedElementFieldYieldHoldget_MatchThresholdset_MatchThresholdthresholdhWnddeadbandget_Commandset_CommandSendAppendSDL_GameControllerButtonBindget_LimitPerSecondset_LimitPerSecondlimitPerSecondadd_NewVersionFoundremove_NewVersionFoundget_WhenWindowFoundset_WhenWindowFoundfoundset_Backgroundset_IsBackgroundSDL_GetSurfaceAlphaModSDL_SetSurfaceAlphaModSDL_GetTextureAlphaModSDL_SetTextureAlphaModhModSDL_GetSurfaceColorModSDL_SetSurfaceColorModSDL_GetTextureColorModSDL_SetTextureColorModget_Methodset_Methodget_MouseMoveMethodset_MouseMoveMethodget_TitleMatchMethodset_TitleMatchMethodget_ColorMatchMethodset_ColorMatchMethodget_TriggerMethodset_TriggerMethodEKeyTriggerMethodtriggerMethodget_KeyMethodset_KeyMethodmethodperiodSDL_KeymodKeyboardSDLK_eSDL_CreateRGBSurfaceSDL_SurfaceSDL_FreeSurfaceSDL_LockSurfaceSDL_UnlockSurfaceSDL_CreateTextureFromSurfaceSDL_BlitSurfaceSDL_ConvertSurfaceSDL_UpdateWindowSurfaceSDL_GetWindowSurfacesurfaceIsNullOrWhiteSpaceSDL_GetTouchDeviceget_TransformToDeviceSDL_CloseAudioDeviceSDL_PauseAudioDeviceSDL_LockAudioDeviceSDL_UnlockAudioDeviceSDL_OpenAudioDevicecdevicejdeviceRunOnceget_TriggerOnceset_TriggerOnceget_MatchToleranceset_MatchToleranceget_ColorToleranceset_ColorTolerancetolerance_leaveAllocatedInstanceCreateInstanceGetInstance_defaultInstancesilenceImageSourcePresentationSourceHideget_StridesStridetStrideGetHashCodevkCodescanCodeSDL_BlendModeSDL_GetSurfaceBlendModeSDL_SetSurfaceBlendModeSDL_GetTextureBlendModeSDL_SetTextureBlendModeSDL_GetRenderDrawBlendModeSDL_SetRenderDrawBlendModeblendModeFileModeSDL_GetRelativeMouseModeSDL_SetRelativeMouseModeImageLockModeSDL_DisplayModeSDL_GetDesktopDisplayModeSDL_GetDisplayModeSDL_GetCurrentDisplayModeSDL_GetClosestDisplayModeSDL_GetWindowDisplayModeSDL_SetWindowDisplayModeget_LegacyModeset_LegacyModeget_UseVirtualKeyModeset_UseVirtualKeyModeuseVirtualKeyModeunicodeSDL_ScancodeSDL_GetKeyFromScancodescancodeSDL_Keycodemodelarge_magnitudesmall_magnitudeSDL_freeSaveSettingsShowAfterInstallPageTargetCachedImageFindImagesourceImageCaptureImageFromImageBitmapImageDrawImageSDL_LogMessagemessageget_UseRangeset_UseRangeCompareExchangecookieEndInvokeBeginInvokeSDL_RenderGetScaleSDL_RenderSetScaleICloneableNullableget_Enableset_Enableget_IsEnableset_IsEnable_isEnableEnumerableKeyboardInputsForEnableDisableIDisposableset_IsHitTestVisibleIsWindowVisibleget_HandleRuntimeTypeHandleGetTypeFromHandleToggletoggleRectangleINTERNAL_SDL_RWFromFileBitmapFromFileSDL_GameControllerAddMappingsFromFileget_LastFileset_LastFileSDL_GLprofileIsVolatileget_Titleset_Titleget_WindowTitleset_WindowTitleSDL_GetWindowTitleSDL_SetWindowTitleFindWindowByTitletitleset_WindowStyleget_NamenativeLibNameSDL_HapticNameSDL_GetAudioDeviceNameSDL_GetScancodeNameset_FileNameSDL_JoystickNameSDL_GetScancodeFromNameSDL_GetKeyFromNameget_ActionNameget_MacroNameset_MacroNamemacroNameget_GroupNameset_GroupNameSDL_GameControllerNamecontrollerNameSDL_GetPixelFormatNameSDL_GetKeyNameget_PropertyNamepropertyNamedriver_nameget_Themeset_ThemeSDL_MessageBoxColorSchemecolorSchemeSystem.Net.Mimeget_NextTimeset_NextTimetimevolumeSDL_IntersectRectAndLineAppendLineSDL_RenderDrawLineCombineIAsyncStateMachineSetStateMachinestateMachineMemberwiseCloneget_IsGenericTypeSDL_GameControllerBindTypebindTypeChangeTypeget_FileTypeset_FileTypeAssociateFileTypeget_IsValueTypeGetUnderlyingTypeSecurityProtocolTypeminTypeget_ActionTypeset_ActionTypeget_LastActionTypeset_LastActionTypeConvertToTypeget_TriggerTypeset_TriggerTypeSDL_MessageBoxColorTypeGetTypeSDL_EventTypemaxTypeget_PropertyTypetypeWhereSystem.CoreTGMacro.CorePresentationCoreget_scorepressurePtrToStructureget_Cultureset_CultureresourceCultureCaptureiscapturedgesturemgestureSDL_GL_BindTextureSDL_GL_UnbindTextureSDL_UpdateTextureSDL_CreateTextureSDL_LockTextureSDL_UnlockTextureSDL_DestroyTextureSDL_QueryTexturetextureMacroTriggerBaseApplicationSettingsBaseWindowsBasetBaseFindPressedKeysAndSendReleasephaseSDL_LogVerboseSDL_HapticCloseSDL_JoystickCloseSDL_GameControllerCloseDisposeDrawEllipseTryParseSDL_HapticPauseSDL_HapticUnpauseMoveMouseSDL_HapticOpenFromMouseSDL_JoystickUpdateSDL_GameControllerUpdateCreateControllerConnectionDelegateControllerButtonPressDelegateMulticastDelegateSDL_TextureModulaterefresh_rateSDL_GetModStateSDL_SetModStateSDL_GetKeyboardStateDebuggerBrowsableStateEditorBrowsableStateSDL_GetRelativeMouseStateSDL_GetMouseStateget_RunStateset_RunStateETriggerRunState_runStateParallelLoopStateSDL_EventStateSDL_JoystickEventStateSDL_GameControllerEventStateSDL_GetEventState<>1__statemodstateget_Whiteget_CanWriteSDL_PaletteSDL_AllocPaletteSDL_SetSurfacePaletteSDL_FreePaletteSDL_SetPixelFormatPalettepaletteCompilerGeneratedAttributeGuidAttributeGeneratedCodeAttributeUnverifiableCodeAttributeDebuggerNonUserCodeAttributeDebuggableAttributeDebuggerBrowsableAttributeEditorBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeCallerMemberNameAttributeAsyncStateMachineAttributeUnsafeValueTypeAttributeScriptIgnoreAttributeDebuggerStepThroughAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeDebuggerHiddenAttributeExtensionAttributeAssemblyFileVersionAttributeSecurityPermissionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeFixedBufferAttributeUnmanagedFunctionPointerAttributeFlagsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeSDL_GL_GetAttributeSDL_GL_SetAttributeAssemblyCopyrightAttributeDebuggerDisplayAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeset_UseShellExecuteget_PositionAbsoluteByteget_Valueget_ActionStringValueget_HasValueaxisValuehatValueTryGetValueSetValueIsDefaultValuevalueblueSaveget_IsAliveMarshalManagedToNativeget_PositionRelativeSDL_IsTextInputActiveIsWindowActiveget_IsPrimitiveRemoveget_SearchAreaSizeset_SearchAreaSizeGetNativeDataSizeSDL_GL_GetDrawableSizeSDL_RenderGetLogicalSizeSDL_RenderSetLogicalSizeSDL_GetWindowMinimumSizeSDL_SetWindowMinimumSizeSDL_GetWindowMaximumSizeSDL_SetWindowMaximumSizeSDL_GetRendererOutputSizeSDL_GetWindowSizeSDL_SetWindowSizeget_SearchAreaSelectorMaxSizeset_SearchAreaSelectorMaxSizeSerializeDeserializesizeSizeOfIndexOfSDLK_fleft_coeffright_coeffaudio_bufSDLK_gflagget_PngSystem.ThreadingSystem.Windows.ThreadingpaddingOrderByDescendingEncodingStopRecordingget_IsRecording_isRecordingStartRecordingSystem.Windows.Media.ImagingSystem.Drawing.ImagingCeilingget_IsRunningset_IsRunningisRunningSystem.Runtime.Versioningget_MousePositioningset_MousePositioningget_DoNotShowAdministratorWarningset_DoNotShowAdministratorWarningSDL_GameControllerAddMappingSDL_GameControllerMappingFromBase64StringToBase64Stringbase64StringSDL_JoystickGetGUIDStringSendStringmappingStringpchStringSDL_JoystickGetGUIDFromStringSDL_GameControllerGetButtonFromStringSDL_GameControllerGetAxisFromStringToStringlpStringget_ColorStringGetStringget_LoopCountStringToFriendlyStringSystem.DrawingSDL_HapticNumEffectsPlayingdwNewLongGetWindowLongSetWindowLongSDL_LogorgmsgSDL_LogDebugSDLK_hmin_hmax_hwhichget_IsFirstLaunchset_IsFirstLaunch_stopSearchfullMatchSDL_AddEventWatchSDL_DelEventWatchpatchget_StopwatchSDL_SoftStretchsrc_pitchdst_pitchSolidColorBrushMathfilePathSDL_GetBasePathSDL_GetPrefPathapplicationPathGetFolderPathget_Widthset_Widthget_MinWidthset_MinWidthsWidthtWidthget_MaxWidthset_MaxWidthmax_texture_widthget_Lengthset_MaxJsonLengthGetWindowTextLengthfade_lengthattack_lengthstrengthEndsWithStartsWithdepthtexhSDLK_iUriSDLK_jManagedObjlockObjobjSDLK_kHookCallBackAsyncCallbackHookCallbackSDL_AudioCallbackSDL_TimerCallbackcallbackSDL_HapticOpenFromJoystickSDL_GameControllerGetJoystickjoystick_lockmemblockhhkidHookCSInputKeyboardHookCSInputMouseHookControllerHookMouseMovementsHookKeyboardInputsHookMouseInputsHookPresentationFrameworkget_TaskAmaskBmaskGmaskRmaskhat_maskSDLK_lAllocHGlobalFreeHGlobalSDL_LogCriticalMarshalDecimalFromVisualamgKeyCodeToVirtualget_Intervalset_IntervalSDL_GL_GetSwapIntervalSDL_GL_SetSwapIntervalintervalKeyboardDataDelMouseDataDelInfoItemModelTestVersionModelVersionInfoModelversionInfoModelMacroModelMacroSettingsModelSystem.Collections.ObjectModelTGMProjectModelSystem.ComponentModelwheelParallelxrelyrelfade_levelattack_levelBytesPerPixelBitsPerPixelGetPixelpixelSDL_HapticStopAllConvertAllSDL_JoystickGetBalljballgdi32.dllshell32.dlluser32.dllSDL2.dllTGMacro.Core.dllToHtmlset_SecurityProtocolSDL_boolControlget_DownloadUrlset_DownloadUrlget_DiscordUrlset_DiscordUrlGuidCheckUrlVersionCheckUrlVisitUrlCtrlurlSDLK_mFileStreamMemoryStreamstreamlParamwParamparamSDL_RWFromMemmemget_ItemSDL_InitSubSystemSDL_QuitSubSystemsubsystemTrimRandom_randomSDL_CreateRGBSurfaceFromSDL_CreateWindowFromSDL_HapticCustomcustomSDL_GetPlatformget_IsEnumSDL_MasksToPixelFormatEnumsyswmSDL_KeysymkeysymSDLK_nresourceManget_IngoreDelayLassThanset_IngoreDelayLassThanIgnoreDelaysLessThanIsLittleEndianTimeSpanPenShowColorLocationsOnTheScreenCaptureScreenCopyFromScreenFindImageOnScreenFindImageCenterOnScreenSDL_SetWindowFullscreengreenaudio_lenSDL_HapticOpenSDL_JoystickOpenSDL_GameControllerOpenlpfnSDL_HapticSetGaingainget_RunAsAdminset_RunAsAdminJoinwinpause_onget_IconSDL_SetWindowIconiconINTERNAL_SysWMDriverUnionSDL_GetRevisionfileExtensionextensionget_Versionset_Versionget_AppVersionset_AppVersionSDL_GetVersioncurrentVersionIsTestVersionSDL_versionApplicationget_RememberLastWindowLocationset_RememberLastWindowLocationlocationCopyPixelOperationDispatcherOperationSystem.ConfigurationSystem.GlobalizationSystem.Web.Script.SerializationTGProjecActionpassedActionFindImageActionMouseMoveActionIMacroActionAMCToMacroActionAmcToMacroActionActionGroupActionWaitForColorActionWaitActionCommentActionTextActionFindWindowActionKeyboardKeyActionMouseKeyActionWaitForKeyActionSecurityActionSDL_eventactionSystem.ReflectionMatchCollectionGroupCollectionSDL_HapticDirectiondirectionSDL_HasIntersectionSDL_LogOutputFunctionSDL_LogGetOutputFunctionSDL_LogSetOutputFunctionSDL_HapticConditionconditionGetGenericTypeDefinitionget_SearchAreaPositionset_SearchAreaPositionGetMousePositionget_UseCursorPositionset_UseCursorPositionget_MainWindowPositionset_MainWindowPositionget_MacroEditorWindowPositionset_MacroEditorWindowPositionget_SettingsWindowPositionset_SettingsWindowPositionSDL_GetWindowPositionSDL_SetWindowPositionCallingConventionmotionget_ImageFoundOptionset_ImageFoundOptionget_ImageNotFoundOptionset_ImageNotFoundOptionInvalidOperationExceptionSetExceptionArgumentExceptionget_Descriptionset_DescriptionextenstionDescriptionPrettifyJsonStringComparisonjsonget_ShowDiscordButtonset_ShowDiscordButtonMouseButtonSDL_GameControllerButtonSDL_GameControllerGetBindForButtonSDL_GameControllerGetStringForButtonSDL_JoystickGetButtonSDL_GameControllerGetButtoncbuttonjbuttonSDL_LogWarnRunDownSDL_IsScreenKeyboardShownMoveToSDLK_oSDL_GetWindowWMInfoget_Infoset_InfodwExtraInfoFieldInfoCultureInfoSDL_LogInfoget_VersionInfoset_VersionInfoversionInfoMemberInfoSDL_RendererInfoSDL_GetRendererInfoSDL_GetRenderDriverInfoProcessStartInfoPropertyInfoSDL_SysWMinfoINTERNAL_x11_wminfoINTERNAL_cocoa_wminfoINTERNAL_directfb_wminfoINTERNAL_windows_wminfoINTERNAL_uikit_wminfoSDL_CloseAudioSDL_PauseAudioget_PlayOnOffAudioset_PlayOnOffAudioSDL_LockAudioSDL_UnlockAudioSDL_OpenAudioget_PlayOnOffMacroAudioset_PlayOnOffMacroAudioSDL_MixAudioget_AutoSaveMacroset_AutoSaveMacromacroZeroUpSDLK_pCachedBitmapOriginalBitmapBase64ToBitmapbitmapClassicSleepset_ToolTipZipSkipSDL_RendererFlipclipflipget_kp_screenBmpSDL_CalculateGammaRampSDL_GetWindowGammaRampSDL_SetWindowGammaRampSDL_HapticRamprampGetTimestamp_lastTimestamptimestampbmpdwRopget_Topset_Topget_KeepActiveMacrosAtTheTopset_KeepActiveMacrosAtTheTopBringWindowToTopWorkLoopdropSystem.Windows.InteropSDL_HapticRumbleStopstopappbppSystem.Net.HttpActionGroupSDLK_qfreqSystem.LinqSDLK_r<score>j__TPar<kp>j__TParset_ShowInTaskbarSDL_RenderClearCharappVerSDL_GetRevisionNumberIFormatProviderAsyncTaskMethodBuilderStringBuilder<>t__builderSpecialFolderOnRenderBinderMacroRecorder<deadband>e__FixedBuffer<left_coeff>e__FixedBuffer<right_coeff>e__FixedBuffer<center>e__FixedBuffer<dir>e__FixedBuffer<texture_formats>e__FixedBuffer<left_sat>e__FixedBuffer<right_sat>e__FixedBuffer<text>e__FixedBufferget_ResourceManagerServicePointManagerKeyboardTriggerMouseTriggerget_MacroTriggerset_MacroTriggermacroTriggerControllerTriggerColorTriggerTestTriggerEmptyTriggerSDL_FingerSDL_GetTouchFingertfingerget_DispatcherICustomMarshalerLPUtf8StrMarshalerEnableStatusChangedEventHandlerPropertyChangedEventHandlerNewVersionFoundEventHandlerTriggerRunStatusEventHandlerTriggerBusyStatusEventHandlerSystem.CodeDom.CompilerTGMacro.Core.Helpers.ControllerSDL_IsGameControllergamecontrollerSDL_AddTimerSDL_RemoveTimerInputListenerset_OwnerImageHelperActionHelperWindowInteropHelperWindowHelperSDL_CreateWindowAndRendererSDL_CreateSoftwareRendererSDL_CreateRendererSDL_GetRendererSDL_DestroyRendererrendererCurrentUseruserConfiguredTaskAwaiterGetAwaiterInputLimiterlimiterSDL_EventFilterSDL_GetEventFilterSDL_SetEventFilterfilterEnterSDL_HapticSetAutocenterautocenterSDL_GetPerformanceCounterJsonNullDefaultValueHidingConverterBitConverterJavaScriptConverterSDL_EnableScreenSaverSDL_DisableScreenSaverSDL_GetVideoDriverSDL_GetCurrentVideoDriverSDL_GetAudioDriverSDL_GetCurrentAudioDriverGetTextFromServerToLowerJavaScriptSerializerserializerdirget_WaitForset_WaitFormajorSDL_Colorget_Colorset_ColorCircleColorWatchColorWaitForColorSDL_GetRenderDrawColorSDL_SetRenderDrawColorSDL_MessageBoxColorfirstcolorminorget_Errorset_ErrorSDL_LogErrorSDL_ClearErrorSDL_GetErrorSDL_SetErrorerrorSDL_FreeCursorSDL_CreateCursorSDL_SystemCursorSDL_CreateSystemCursorSDL_CreateColorCursorSDL_GetCursorSDL_SetCursorSDL_ShowCursorcursorColorTranslatorIEnumeratorGetEnumeratorActivator.ctor.cctorMonitorStructureToPtrIntPtrSDL_GLattrDefaultTickMsSDLK_sAbsGraphics_graphicsSDL_NumHapticsSystem.DiagnosticsplayComandsget_TotalMillisecondsSDL_GetDisplayBoundsNativeMethodsEColorTriggerMethodsEKeyPressMethodsSDL_GetNumTouchDevicesSDL_GetNumAudioDevicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesTGMacro.Core.Properties.Resources.resourcesDebuggingModesSDL_GetNumDisplayModesallowed_changesColorMatchesColorNotMatchesBrushesUtilitiesSDL_LogResetPrioritiesTGMacro.Core.PropertiesGetPropertiessamplesMediaTypeNamesSDL_RenderDrawLinesget_SupportedTypesEActionTypesEMacroActionTypesETriggerTypesCheckForUpdatesget_DoNotShowOfficialWebsitesset_DoNotShowOfficialWebsitesGetCustomAttributesSDL_GL_ResetAttributesGetBytesbytesSDL_HapticNumAxesSDL_JoystickNumAxesget_FlagsBindingFlagsSDL_MessageBoxButtonFlagsSDL_RendererFlagsuFlagsSDL_WindowFlagsSDL_GetWindowFlagsSDL_MessageBoxFlagsKeyFlagswindow_flagsget_GetKeyStringsgetKeyStringsLoadSettingsUpdateSettingsSaveSettingsget_MacroSettingsset_MacroSettingsAppSettingssetDefaultSettingsPropertyChangedEventArgs<>4__thisSDL_GameControllerAxisSDL_GameControllerGetBindForAxisSDL_GameControllerGetStringForAxisSDL_JoystickGetAxisSDL_GameControllerGetAxiscaxisjaxisSDL_GetTicksclicksSDL_NumJoysticksSDL_PixelFormatEnumToMasksSystem.Threading.TasksSDL_RectEqualsTGMacro.Core.Core.ModelsTGMacro.Core.ModelschannelsSDL_RenderReadPixelsSDL_QueryTexturePixelsSDL_ConvertPixelspixelsSDL_JoystickNumBallsSystem.Windows.ControlsTGMacro.Core.EnumsTGMacro.CSInputs.EnumsContainsSystem.Web.ExtensionsEnumExtensionsSystem.Text.RegularExpressionsSystem.Security.PermissionsRefreshAssociationsiterationsget_Actionsset_ActionsGetInvalidActionsClipboardActionsallActionsApplyAutoDelayToActionsTGMacro.Core.Core.MacroActionsTGMacro.Core.MacroActionsmacroActionsactionsSystem.CollectionsStringSplitOptionsRegexOptionsget_PressedButtonspressedButtonsSDL_JoystickNumButtonsnumbuttonsnXPosnYPosget_Posset_Posget_MousePosset_MousePosGetCursorPosposget_Macrosset_Macrosget_Groupsget_CharsTGMacro.Core.MacroTriggersTGProjectTriggersSDL_GetNumTouchFingersnumFingersDownModifiersUpModifiersget_KeyModifiersset_KeyModifiersget_RecordKeyModifiersset_RecordKeyModifiersget_EnableKeyModifiersset_EnableKeyModifiersget_ActivationKeyModifiersset_ActivationKeyModifiersget_TriggerKeyModifiersset_TriggerKeyModifiersmodifierscontrollersTGMacro.Core.Core.HelpersTGMacro.Core.Helpersget_Parametersset_ParametersSystemParametersTGMacro.Core.ConvertersSDL_GetNumVideoDriversSDL_GetNumAudioDriversSDL_GetNumRenderDriversSDL_SetPaletteColorsncolorsFileAccessSDL_TextureAccessaccessProcessSDL_GetWindowBrightnessSDL_SetWindowBrightnessbrightnessadd_ControllerButtonPressremove_ControllerButtonPressSDL_GL_GetProcAddressaddressAlossBlossGlossRlossSDL_JoystickNumHatsnum_texture_formatsTGMacro.Core.AbstractsSDL_UpdateWindowSurfaceRectsSDL_FillRectsSDL_RenderFillRectsSDL_RenderDrawRectsSDL_HapticNumEffectsnumrectsTGMacro.CSInputs.StructsLockBitsUnlockBitsbitsadd_MouseMovementsremove_MouseMovementsget_RecordMouseMovementsset_RecordMouseMovementsset_ArgumentsSDL_FlushEventsUnsubscribeAllEventsSDL_PeepEventsSDL_PumpEventsSDL_FilterEventsSDL_RegisterEventsSDL_HasEventsnumeventsSDL_ClearHintsSDL_EnclosePointsSDL_RenderDrawPointsget_KeyPointsset_KeyPointsComputeKeyPointspointsExistsTGMacro.CSInputsadd_KeyboardInputsremove_KeyboardInputsInputListener_KeyboardInputsadd_MouseInputsremove_MouseInputsInputListener_MouseInputsget_IgnoreSelfInputsset_IgnoreSelfInputsSDL_GetKeyboardFocusSDL_GetMouseFocusSDL_GetAudioDeviceStatusSDL_AudioStatusSDL_GetAudioStatusSDL_HapticGetEffectStatusTGMacro.Core.WindowsSystem.WindowsEnumWindowsLeftWindowsRightWindowsget_RecordDelaysset_RecordDelaysSDL_GetNumVideoDisplaysDisposeOverlaysShowHideOverlayColorOverlaysSuppressedKeysRecordKeyboardKeysget_RecordKeybordKeysset_RecordKeybordKeysget_RecordMouseKeysset_RecordMouseKeysget_ControllerTriggerKeysset_ControllerTriggerKeysGetEModifierKeysget_ModifierKeysset_ModifierKeysnumkeysGetColorAtGetHexColorAtElementAtSDLK_tSDL_JoystickGetHatConcatrepeatINTERNAL_GameControllerButtonBind_hatjhatSDL_AllocFormatSDL_ConvertSurfaceFormatSDL_FreeFormatImageFormatSDL_PixelFormatSDL_GetWindowPixelFormatSDL_MixAudioFormatsrc_formatpixel_formatdst_formatleft_satright_satSDL_RectSDL_FillRectSDL_RenderFillRectSDL_UnionRectSDL_GetClipRectSDL_RenderGetClipRectSDL_SetClipRectSDL_RenderSetClipRectSDL_IntersectRectSDL_SetTextInputRectSDL_RenderDrawRectSDL_HapticEffectSDL_HapticUpdateEffectSDL_HapticRunEffectSDL_HapticStopEffectSDL_HapticNewEffectSDL_HapticDestroyEffecteffectDispatcherObjectobjectSelectclip_rectsrcrectdstrectSystem.NetMacroTriggerSetget_CompositionTargetSDL_GetRenderTargetSDL_SetRenderTargettargetoffsetget_Leftset_LeftLeftShiftRightShiftAshiftBshiftGshiftRshiftSDL_HapticLeftRightget_Heightset_Heightget_PrimaryScreenHeightget_MinHeightset_MinHeighttHeightget_MaxHeightset_MaxHeightmax_texture_heightleftrightSpinWaitConfigureAwaitop_ExplicitedituikitSDL_UpperBlitSDL_LowerBlitSplitget_InputLimitset_InputLimitSDL_InitSDL_HapticRumbleInitSDL_VideoInitSDL_AudioInitSDL_WasInitSDL_QuitSDL_VideoQuitSDL_AudioQuitquitExitAltBitBltget_DefaultGetValueOrDefaultget_ResultIAsyncResultParallelLoopResultGetResultSetResultresultfmtSDL_HapticConstantconstantHttpClientUIElementFrameworkElementCommentEnvironmentget_Transparentget_CurrentSDL_GL_MakeCurrentSDL_RenderPresentSDL_SysWMEventSDL_EventSDL_GenericEventSDL_KeyboardEventInjectKeyboardEventSDL_ControllerDeviceEventSDL_JoyDeviceEventSDL_MultiGestureEventSDL_DollarGestureEventSDL_TextEditingEventSDL_PushEventSDL_FlushEventSDL_MouseWheelEventSDL_JoyBallEventSDL_PollEventSDL_MouseMotionEventSDL_MouseButtonEventSDL_ControllerButtonEventSDL_JoyButtonEventSDL_DropEventSDL_TouchFingerEventSDL_UserEventSDL_HasEventSDL_ControllerAxisEventSDL_JoyAxisEventSDL_JoyHatEventSDL_WaitEventSDL_QuitEventSDL_TextInputEventSDL_WindowEventwindowEvent_eventsdleventSDL_GetHintSDL_SetHintWin32PointSDL_PointSDL_RenderDrawPointKeyPointSDL_GetCPUCountget_Countget_LoopCountset_LoopCountnMaxCountrefcountget_ScrollAmountset_ScrollAmountget_SleepAmountset_SleepAmountExceptThreadStartget_EnableOnStartset_EnableOnStartget_LoadLastMacroOnStartset_LoadLastMacroOnStartstartConvertAbortSDL_HasScreenKeyboardSupportget_EnableControllerSupportset_EnableControllerSupportSDL_RenderGetViewportSDL_RenderSetViewportdstclosestdDistGetInvocationListToListset_TopmostFirstSDL_WaitEventTimeouttimeoutlayoutAmcInputTGMacro.CSInputs.ReadInputTGMacro.CSInputs.SendInputSDL_StopTextInputSDL_StartTextInputMoveNextSystem.Textget_Textset_TextSDL_HasClipboardTextSDL_GetClipboardTextSDL_SetClipboardTextReadAllTextWriteAllTextget_NoTextset_NoTextget_YesTextset_YesTextget_CommentTextset_CommentTextGetWindowTextnextSDL_GL_CreateContextSDL_GL_DeleteContextDrawingContextSetProcessDpiAwarenessContextSDL_GL_GetCurrentContextSDL_GLcontextSDLK_uSDLK_vdevSDLK_wmin_wmax_wStartNewFindWindowGetForegroundWindowSetForegroundWindowSDL_HideWindowSDL_RestoreWindowSDL_RaiseWindowSDL_CreateWindowSDL_MinimizeWindowSDL_MaximizeWindowSDL_WarpMouseInWindowSDL_GL_SwapWindowSDL_GL_GetCurrentWindowSDL_ShowWindowget_OverlayWindowset_OverlayWindowSDL_DestroyWindowwindownCmdShowfreerwtexwUnhookWindowsHookExSetWindowsHookExCallNextHookExSDL_RenderCopyExSDLK_xhot_xMaxmaxdxColorToHexSDL_HapticIndexmodeIndexnIndexSDL_JoystickNameForIndexSDL_GameControllerNameForIndexSDL_GetWindowDisplayIndexdisplayIndexfirstKeyIndexdevice_indexjoystick_indexRegexMatrixSDL_ShowSimpleMessageBoxINTERNAL_SDL_ShowMessageBoxSDLK_yhot_ySDL_HapticRumblePlaySDL_DelayuseAutoDelayautoDelaydelaydisplayToArraymimicLegacyset_AllowsTransparencySDL_GetPerformanceFrequencySDL_SetMainReadyget_Keyset_KeyCreateSubKeyget_KeyboardKeyset_KeyboardKeyget_RecordKeyset_RecordKeyget_EnableKeyset_EnableKeyget_MouseKeyset_MouseKeySDL_GetScancodeFromKeyget_ActivationKeyset_ActivationKeyfindNextActionKeyget_TriggerKeyset_TriggerKeyget_SuppressTriggerKeyset_SuppressTriggerKeytriggerKeyModifierKeymodifierKeyWaitForKeySDL_GetColorKeySDL_SetColorKeyContainsKeyRegistryKeykeySHChangeNotifyget_AssemblyAsReadOnlyAnySDL_RenderCopydictionarySDL_HapticQuerycategoryMacroDirectoryRegistryget_IsBusyset_IsBusyisBusyget_Capacityop_Equalityop_InequalityGetColorSimilaritySDL_LogPrioritySDL_SetHintWithPrioritySDL_LogSetAllPrioritySDL_LogGetPrioritySDL_LogSetPrioritySDL_HintPriorityprioritySystem.SecuritySDL_RectEmptySDLK_z7{{ kp = {0} score = {1} }}\TGMacro;https://discord.gg/gJ5ZNt4AAW'#{0:X2}{1:X2}{2:X2}settings.jsonhttps://trksyln.net/projects/tgm-gaming-macro-tgmacro/installedMhttps://gettgmacro.com/validguids.jsonI1a8b7942-65f0-4415-b381-17b9f3f59f05#Software\Classes\%shell\open\command" " "%1"CTGMacro.Core.Properties.ResourcesMacroNameIsEnable IconIsRunning IsBusyepack://application:,,,/Images/actions/color_48.pngkpack://application:,,,/Images/actions/keyboard_48.pngepack://application:,,,/Images/actions/mouse_48.pngopack://application:,,,/Images/actions/controller_48.pngopack://application:,,,/Images/actions/color_gray_48.pngupack://application:,,,/Images/actions/keyboard_gray_48.pngopack://application:,,,/Images/actions/mouse_gray_48.pngypack://application:,,,/Images/actions/controller_gray_48.pngMacroTriggerGetKeyStrings iconOnce, Color at +As long as, Color at cursor pos. ({0}, {1})matches with !NOT matches with{0},{1},{2} + Once, When ButtonpressedAs long as!pressed and hold+Starts and stops whenOnce, Whenreleased grayETGM Gaming Macro Project (TGMacro){0};{1};{2}{0};{1};OK NoneGroup", Loop: , Actions: My groupCmt/Type your comment here!KeyboardMouse ( Rel. Abs. X: , Y: ) Move FImg1Search image at {0}, {1} Text)Type your text here!WaitC#matches color at /doesn t match color at cursor Wait Milliseconds-{0} - {1} MillisecondsWaitKWait until () )TGMacro color target{Error converting value '{0}' to property '{1}' of type '{2}'. FWinFind window ()LeaveAllocated9ManagedObj must be a string.ManagedObjrbwb-<Syntax>(.*?)</Syntax>mover movetodelay downupkeywheelupwheeldown leftright middleleftdown leftup openyC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeIhttps://gettgmacro.com/manifest.json̏/pC2;5 E ] q q mq - A q E Amm E %%0 40 1 9 9 == EA A IME lm$mm$m$$$$$$$$$$m$m$$#EEE $$ $QE $mE $m$ $$$ LX\TLX\T) Y$a i q( mE"mLX\-Tm hEE h E%%% % 5m<% \XTLm@ E =h= hm@6tpl|hdxm@ Eh h hEEEEE8I- d A - -A QQ - - Ya Q e ]aQ e m i m yyqqq yu qqqq qqq q }yyu} y q Eq QQ@ QQ A D'mmlplpllpp qLLL LHHH Hmh } E &<d "|h|hhEh Qxq L )mm % EE?&m } 0mdlpdEE &lp -A EE -) 0 D m 99 9 h 1 19 909 z\V418V6N5?_ :H1a8b7942-65f0-4415-b381-17b9f3f59f05Lhttps://gettgmacro.com/validguids.jsonHhttps://gettgmacro.com/manifest.json -@LeaveAllocatedSDL2.dll 128SDL_FRAMEBUFFER_ACCELERATION"SDL_RENDER_DRIVER2SDL_RENDER_OPENGL_SHADERS<SDL_RENDER_DIRECT3D_THREADSAFE SDL_RENDER_VSYNC SDL_VIDEO_X11_XVIDMODE SDL_VIDEO_X11_XINERAMA(SDL_VIDEO_X11_XRANDR"SDL_GRAB_KEYBOARD@SDL_VIDEO_MINIMIZE_ON_FOCUS_LOSS6SDL_IOS_IDLE_TIMER_DISABLED(SDL_IOS_ORIENTATIONS$SDL_XINPUT_ENABLED0SDL_GAMECONTROLLERCONFIGHSDL_JOYSTICK_ALLOW_BACKGROUND_EVENTS"SDL_ALLOW_TOPMOST(SDL_TIMER_RESOLUTION0SDL_RENDER_SCALE_QUALITY4SDL_VIDEO_HIGHDPI_DISABLEDDSDL_CTRL_CLICK_EMULATE_RIGHT_CLICK2SDL_VIDEO_WIN_D3DCOMPILER8SDL_MOUSE_RELATIVE_MODE_WARPFSDL_VIDEO_WINDOW_SHARE_PIXEL_FORMAT6SDL_VIDEO_ALLOW_SCREENSAVER:SDL_ACCELEROMETER_AS_JOYSTICK>SDL_VIDEO_MAC_FULLSCREEN_SPACES /@ @{ [\@ PQRSTU !"#$%&'()*+ -./0123456789:;<=>?ABCDEFGHIJKLMNOPQRSTUVWXYZ]^_`abcdefghijklmnopqrstuvwxyz{|}~ 9@:@;@<@=@>@?@@@A@B@C@D@E@F@G@H@I@J@K@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @@@ @@@@@@@@@@@@@@@?.System.Security.Permissions.SecurityPermissionAttribute mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089TSkipVerification< 7TGMacro.Core.Helpers.Controller.SDL2.LPUtf8StrMarshalerJ 7TGMacro.Core.Helpers.Controller.SDL2.LPUtf8StrMarshalerLeaveAllocated******imDq4uy $)%m<@ Hh I--(UA}LHmh }i$$$ h,9 9, =h04 h< QPTX`dtpl QxT048 $(,DHLPX`dhltx|m (DDqq $ $ ) % m< m< @ @ H H h h h hA - - A uqu uu q Eq Q( Q ( LH h P PTXXXX \\ | ` PPP P P P PPP P P <DPP <<@P@ LHPPHLHHLL P X Pdd pddhh phh P EE D D $$ $ h h h hA X X m m ((Dq( ($(()(((((((m<((@((( (H(((((h(-(((((((A (Eq( h((mTWrapNonExceptionThrowsTGMacro.CoreTGM Gaming Macro Coretrksyln.netCopyright © 2024TGMacroCore)$253e82fd-1600-40be-920a-d498216a15341.0.0.0I.NETFramework Version=v4.5TFrameworkDisplayName.NET Framework 4.5*%TGMacro.Core.Utilities+<VisitUrl>d__72-TGMacro.Core.Utilities+<CheckForUpdates>d__104/TGMacro.Core.Utilities+<GetTextFromServer>d__12WRTGMacro.Core.Models.MacroModel+<>c__DisplayClass26_0+<<MacroRunStateChanged>b__1>dcZSystem.UInt32 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089aXSystem.Byte mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089 (B3) (B4) (B1) (B2) (Sel)(Home)(Menu) (LS) (RS) (L1) (R1) (DUp)(DDown)(DLeft) (DRight) (L2) (R2)bYSystem.Int32 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089cZSystem.UInt16 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089bYSystem.Int16 mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089<\{ kp = {kp} score = {score} }TType<Anonymous Type>A3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.14.0.0lSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP\JvRSDS&SNC:\Users\tarik.saylan\source\repos\trksyln\TGUI\TGMacro.Core\obj\x86\Release\TGMacro.Core.pdb _CorDllMainmscoree.dll% 0HX4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0DCommentsTGM Gaming Macro Core8CompanyNametrksyln.netB FileDescriptionTGMacro.Core0FileVersion1.0.0.0BInternalNameTGMacro.Core.dllHLegalCopyrightCopyright 2024@LegalTrademarksTGMacroCoreJOriginalFilenameTGMacro.Core.dll: ProductNameTGMacro.Core4ProductVersion1.0.0.08Assembly Version1.0.0.0?", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELiK!0JFh `gO<g8 H.textH J `.rsrcL@@.relocP@B&hH1x5f~***&( *09~ ,"rp( o s ~+*0~ +*"*0~ +*"( *Vs ( t*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*f(( (*0 ,+ .+ + +[.S\.N%.I'.D&.?(.:-.5..0$.+#.&!.!". . .[.\+,` (-+}#}(0}} ~A}}0}$~2~2~1(2&*0$ +o (X o -*0 }}} ~A}}0 }}} ~A}}0 }#}$}#}$( ( (2&*( ( 12*07~ ( [. R+ ,~ (*F~ (*02( [3 R+ ,(*0<, ( [. R+ ,Zh [. \+, +/ Q. R+, + .+Z }(! ("}(" (!},+ . 3+Z`}~A}}/}$%( ( (2&*0 }(! ("}(" (!},+ }~A} }/}$%( ( (2&*0? ,0(# o$ (% X Z(# o$ (& [++*0? ,0(# o$ (' X Z(# o$ (( [++*0){3 () t|3(+ 3*0){3 (+ t|3(+ 3*0){4 () t|4(+ 3*0){4 (+ t|4(+ 3*0){5 () t|5(+ 3*0){5 (+ t|5(+ 3*0s, }7}8}9(- }8}9s. %o/ %o0 %o1 %o2 % o3 o4 (5 (*s-}6*0 % }( })}'}* % }( })}'}* i ( ( (3&*05{3%-&+'((|6o8*07(6 9( ( ( ( (7 (4 ,8{3,6{%{+3'( {&{{(8 +9{9,{&{{~A(9 +,8_{&{{ _,|&|} +|&|} {8,1{&{{ -{7{&{{o: + ,8{8,4{&{{ -!{7{&{{o: + ,{7{&{{o; {8,2{&{{ 3{7{&{{o: +,{7{&{{o< &{&{{,2|&|{&{{*. + }{3%-&+H {&{{( {&{{ ( |6o8{5-{4,{%{++9D{9,!{&{{"n~A(9 j+,8(= {:~ (> ,}:(! |:(! Y(" |:(" Ys? (({&{{9+s@ %(A {&{{ ,x{&{{0 \+ [(({4%-&+|6o<({4%-&+|6o<{&{{ ,x{&{{0 Q+ R(({4%-&+|6o<({4%-&+|6o<8{&{{(B _,<(B (({4%-&+|6o<{&{{(B _,< (B ( ({4%-&+ |6o<XoC !!:!+W{&{{-{:((D +"",)(}:{5%-&+|6o<(E *r( .s7o#*0( [5.V+.c+[.p8\.z+ .+ .+x( _};+d( _}<+P( _}=+<( _}>+(( _}?+( _}@+*"( *~sF ? oG (H A*BSJBv4.0.30319l#~D,#Stringsp-P#US-#GUID-#BlobW= 37>RH? bSx {6 Gx gx 6x :l -Gs sQUYG=G: GZGSGOGG x G| GG m GO HGGNGAAAi WmWmfWm WmWmWm0m#-m%m'm+m/iA1A3" y3#A;- AA/EB7E7@I7VL7c 7 7A7m7 7 ;m?'_*q.2-6:* >k>A&A`D>:>6Y-G:A&A`D>G&K&A&ATNRV;>H>ADMZh D@D!^b1^ 1fkooms!1w!'v '0''#'-'='I'ND>VVi>V=:V:VV:VZViZ>V!6V6V6V 6V6V|6V6V5 6VH6V6VI 6V6V06V-6V6Vs 6V6V6V 6V6V&6V6V6V6Va6V6V6V6VB6V6V6V6V6V@6V6Vy6V6V6V6V6V6V,6VN6V6VA6V\6Vs6V6V6V6V6V6V6V6V6V6V6V 6V6V6V6V6V46V66V>6V@6VB6VD6VF6VH6VJ6VL6VN6VV6V6V6V6V=6VI6V6V6V/6VX6V6VD6V_6Vv6V6V6V6V6VC 6V6V6VV 6Vz6V 6V6VF6V6V96VT6Vk6V6V6V6V6V6V76V6V6VL6Vg6V~6V6V6V6V6V;6V6V6VP6Vk 6V` 6V 6Vc6V@6V'6V46V6V6V6V6VP6VY6V. 6V6V&6V6VQ 6V/6V6V6V 6V6V`6V6VI6V6V6V&6V\6V6V<6VW6Vn6V6V6V6VX6V6V6V6V6V6V6V6V6V?6V6V6V+6V 6V86V 6V6Vx6VP6VA6V;6V 6V 6V6V6VU6V6VB6V6>V!GVGVGVGVsGVGVGVrGVGVGV'GVGV VF 3iP W %_ f g ` t Y e 1 ` f !!#!+!4!<!E!M!V!^! g!% o!: x!P !P " " #f #P$P4$P t$P%E!h&)&j) '0"8'0#p'6$'6%'p6&(6'P(` <(( B*t)_G+)p-/` O.0U/ q^1 c2 Li4 m4 v7 :0` ?0f ?` ?UAC|G` IKM|Q ;9 'Q'Q'Q'QQ ]0 " 7W W ,FV U""H JU""H J ` ` ` )` 1` 9` A` I` Q` Y` a` i` q` y` ` ` ` ` ` &)` ` 141=` C` IUQ^Y>zY ao #it ^q{q ^ ylyO ` ` ` d 5!Z!bgmO gs x` ` xp` 6!="I"Y"m"%% (,48<@DHLPTX\`dhlptx |!$'*-0369<?BEHKNQTWZ]`cfilorux{~ $(,048<@DHLPTX\`dhlptx| #&),/258;>AD G$J(M,P0S4V8Y<\@_DbHeLhPkTnXq\t`wdzh}lptx| (,048 < @DHLPT\` {!{!....#.+(.3G.;M.C.K^.S.[G.cv.k.s@{Iccc{i{B{{`{{{{{{ {@{A{A`{a{a{{{{{c{`{{{{{{a{a{{< !"/0 KPcu %txx)y5 > #$%&'( _qacL@e@g iPhLG KUUICO00F10F20__StaticArrayInitTypeSize=60N0Numpad0F11F21OEMPA1F1OEM1N1List`1Numpad1LaunchApplication1XButton1ExtraButton1OEM102F12F22User32user32OEMPA2F2OEM2N2Numpad2LaunchApplication2XButton2ExtraButton2F13F23OEMPA3BBE845544E7DADE109E92B8271D4E966C22C84759757B05C359D2654461B54D3F3OEM3N3Numpad3F14F24F4OEM4N4Numpad4F15F5OEM5N5Numpad5F16F6OEM6N6Numpad6F17F7OEM7N7Numpad7F18F8OEM8N8Numpad8F19F9N9Numpad9<Module><PrivateImplementationDetails>ABCDEEREOFGHIJKRI_MOUSE_HWHEELRI_MOUSE_WHEELMOEMATTNOPQRSTUVOEMENLWOEMAXget_Xset_XCalculateAbsoluteCoordinateXLastXget_Yset_YCalculateAbsoluteCoordinateYLastYZvalue__HanjaJunjaOEMCommaKanaKeyboardDataMouseDatamouseDataButtonDatapDataGetRawInputDatadataFujitsu_LoyaFujitsu_RoyaOEMBackTabmscorlibSystem.Collections.GenericWndProcThreadAddInterlockedIsDefinedReservedSynchronized<UseVirtualKeyMode>k__BackingField<PositionAbsolute>k__BackingField<PositionRelative>k__BackingField<Flags>k__BackingField<Key>k__BackingFieldEnduiCommandSendmethodOEMPeriodRawKeyboardMouseWheelBackwardMouseWheelForwardBrowserForwardSpacehDeviceRawInputDeviceNotifyKeyDownsOncenotifyKeyDownsOncedefaultInstanceDivideMakeCodeuCodeget_UseVirtualKeyModeset_UseVirtualKeyModeUsagePageHIDUsageGetCSInputsMessageModeChangeCompareExchangeEndInvokeBeginInvokeMouseMiddleget_HandleRuntimeFieldHandleRuntimeTypeHandleCreateHandleGetTypeFromHandlehandleRectangleset_StyleNonametimeHomeCombineNoneEscapeValueTypeuMapTypeRawInputTypedwTypetypeget_Cultureset_CultureresourceCultureApplicationSettingsBaseMediaPlayPauseRawMouseMulticastDelegateDebuggerBrowsableStateEditorBrowsableStateDeleteCompilerGeneratedAttributeGuidAttributeGeneratedCodeAttributeDebuggerNonUserCodeAttributeDebuggableAttributeDebuggerBrowsableAttributeEditorBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeFlagsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeExecuteget_PositionAbsoluteset_PositionAbsolutevalueget_PositionRelativeset_PositionRelativeRemovepcbSizeInputSizedwSizeSizeOfIgnoreSelfignoreSelfflagSystem.ThreadingSystem.Runtime.VersioningMousePositioningSendStringSystem.Drawingget_MsgchOEMFinishMathget_Widthset_Widthget_LengthGetLengthwVkBrowserBackAsyncCallbackcallbackMediaNextTrackScrollLockNumLockCapsLockMarshalDecimalFinalEqualKeyboardDataDelMouseDataDelCRSelOEMCUSelEXSelCancelSystem.ComponentModelLaunchMailuser32.dllTGMacro.CSInputs.dllLeftControlRightControlOEMWSCtrlget_LParamwParamSystemRandomZoomEnumresourceManwScanVkKeyScanget_PrimaryScreenUnionApplicationExtraInformationSystem.ConfigurationSystem.GlobalizationSystem.Reflectionget_PositionMiddleButtonLeftButtonRightButtonPageDownVolumeDownkeysAreDownKeyDownMoveToGetMessageExtraInfodwExtraInfoCultureInfoOEMAutoPageUpVolumeUpKeyUpSleepICOHelpOEMJumpMediaStopOEMClearICOClearSendCharPrintScrcbSizeHeaderRawInputHeaderget_ResourceManagerSystem.CodeDom.CompilerInputListenerlistenercharacterNumpadEnterCursorSeparator.ctor.cctorIntPtrAbsSystem.Diagnosticsget_BoundsTGMacro.CSInputs.NativeMethodsuiNumDevicesRegisterDevicespRawInputDevicesRegisterRawInputDevicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesTGMacro.CSInputs.Properties.Resources.resourcesDebuggingModesTGMacro.CSInputs.Propertiesget_Flagsset_FlagsdwFlagsKeyFlagsflagsSettingsCreateParamsSystem.Windows.FormsTGMacro.CSInputs.EnumsContainsRawButtonsmousePosLastCursorPosget_CharsRuntimeHelpersTGMacro.CSInputs.Structsadd_MouseMovementsremove_MouseMovementsTGMacro.CSInputsadd_KeyboardInputsremove_KeyboardInputsListener_KeyboardInputsadd_MouseInputsremove_MouseInputsnInputspInputsOEMPlusOEMMinusMediaPreviousLeftWindowsRightWindowsKeyboardKeysMouseKeysModifierKeysSubtractObjectobjectLaunchMediaSelectGetHwndTargetPacketOEMResetMouseLeftMouseWheelLeftLeftShiftRightShiftMouseRightMouseWheelRightget_Heightset_Heightop_ExplicitAltget_DefaultIAsyncResultresultmouseMovementInjectKeyboardEventPointPrintscrollAmountAcceptInsertNonConvertTGMacro.CSInputs.Structs.InputTGMacro.CSInputs.ReadInputTGMacro.CSInputs.SendInputKeyboardInputkeyboardInputMouseInputmouseInputhRawInputNexttextFujitsu_TourokuLeftMenuRightMenuFujitsu_MasshouNativeWindowdxPlayInitializeArrayinputArraydyget_Keyset_KeyMapVirtualKeyModifierKeymodifierKeyProcessKeykeyget_AssemblyMultiplyOEMCopyop_Equalityop_InequalityEmptyKTGMacro.CSInputs.Properties.Resourcesأg/I>0c I aYY ] ,XX,< ,<<<q,<<$ ,<<$u uttt txxx x}` 444#0q qqq ``z\V4?_ : !"#$%&'()*+ -./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]_`abcdefghijklmnopqrstuvwxyz{|}~@[\QR<Y]`X d<8p\$ txL}`Th|(Y]] ` ` X X d d q q``XddX dqhdXqhqhh t x `X H L ,4 0 L L L LY](`(X(d(qTWrapNonExceptionThrows CSInputswindows api input librarytrksyln.netCopyright © 2021)$3b666193-fd40-4a29-849a-8f7f8f03f1971.0.4.0I.NETFramework Version=v4.5TFrameworkDisplayName.NET Framework 4.5A3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.14.0.0lSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP9~tgtIRSDS0ߌGI-}ZC:\Users\tarik.saylan\source\repos\trksyln\TGUI\TGMacro.CSInputs\obj\x86\Release\TGMacro.CSInputs.pdbh4h &h_CorDllMainmscoree.dll% @@0HX4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0LCommentswindows api input library8CompanyNametrksyln.net: FileDescriptionCSInputs0FileVersion1.0.4.0JInternalNameTGMacro.CSInputs.dllHLegalCopyrightCopyright 2021: LegalTrademarksCSInputsROriginalFilenameTGMacro.CSInputs.dll2 ProductNameCSInputs4ProductVersion1.0.4.08Assembly Version1.0.4.0`H8"5e:T57a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp")5f:T41a,GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197360:T428,GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197361:T447,GET /wp-content/uploads/2026/02/dotnetLogo.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197362:T458,GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197363:T451,GET /wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197364:T413,GET /wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611973$j60$l0$h0; _ga=GA1.1.193386372.177761197365:T609,GET /wp-content/plugins/gtranslate/flags/svg/en.svg HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h066:T5e2,GET /wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h067:T5e6,GET /wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611975$j60$l0$h068:T5e2,GET /wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h069:T5e2,GET /wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06a:T5e2,GET /wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06b:T5fb,GET /wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06c:T60b,GET /wp-content/uploads/2026/02/cropped-tgm-32x32.png HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06d:T5e2,GET /wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06e:T5f3,GET /wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29 HTTP/1.1 Host: trksyln.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; _gcl_au=1.1.1090214966.1777611973; _ga=GA1.1.193386372.1777611973; FCNEC=%5B%5B%22AKsRol_TzNoLGnUX3gDbirGz-MWetV-jxTZ-JvKvBZn6lVvZQHQZ9ucSE-RNps886fUbRQN_m747ZKwPJwcL0-TEaSPbxpw-7zXTNx4IxPvQEQqp1du-t_c53Y5aCCsUWEhPGx4YW8DNa8nwoZDg1ppHLB5kMBiHZg%3D%3D%22%5D%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D; __gads=ID=9c10a98642ea9dd4:T=1777586462:RT=1777586462:S=ALNI_MYugQEdtAxLWpPG12gosZ-Ro5yx0g; __gpi=UID=0000136710b4140e:T=1777586462:RT=1777586462:S=ALNI_MacC9jlJ3RrpBTS1tTm4HypixKFjg; __eoi=ID=22b6769427b4c265:T=1777586462:RT=1777586462:S=AA-AfjZTBU4BFrm5VfcpqTeydTYs; _ga_JH2MNQ1WXY=GS2.1.s1777611973$o1$g0$t1777611976$j59$l0$h06f:T501,POST /g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968 HTTP/2 Host: analytics.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://trksyln.net/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Origin: https://trksyln.net Priority: u=1, i Accept: */* Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty70:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAABERERERERERERERERAAAAOZmZmZmZmZmZmZmZmZEAATmTMzMzMzMRERkRGZmZAAMzMAAHd3d3d3d3d3cZmRADMwB3d3d3d3d3d3d3c5kQAzMAB3d3d3d3d3d3d3cZEAMzAAAHd3d3d3d3d3d3GRADMwAAAAd3d3d3d3d3dxkQAzMAAAAAB3d3d3d3d3cZEAMzAHcAd3d3d3d3d3d3GRADMweIcHiHeHd3iHePdxkQAzMHiHB4h3eHd4h3iHcZEHMzAAAAd3d3d3d3d3d3GRBzMwAHd3d3h4d4d3d4dxkQczMACPh3///3/3iHj3cZEHMzAAj4ePiP9/9/9493GRBzMwB4+H/3j/f/j/+PcDkQczMACPh/94/3/////3A5EHMzd3j4ePiIh//4f/9wORBzM3////f///f/9wj/cDkQczMHiIiHd4iHeHAHiHA5EHM3AAAABwAAAAAAAAAAORBzMwAAAAAHAAAAAAAAADkQczdwAAAAAAAAAAAAAAA5EHM3cAAABwAAAAAAAAAAORBzMwAAAAAAAAAAAAAAADkQczM3AAAAAAAAAAAAAAOZEHczMzMzMzMzMzMzMzMzmRB3MzMzMzMzMzMzMzMzMzMQd3czMzMzMzMzMzMzMzMzcAd3d3d3d3d3d3d3d3d3d3CAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAQ==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790568857019,"unified_at":"2026-09-28T04:14:17.019Z","metadata":{"hashes":{"sha256":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","sha1":"a1025fdc8676ee922f464f67b87c33f1b2cbeb55","md5":"5c3c2231b01a9b769b94962b73d0286d","sha512":"f1fa002ac370a5012df15231a8725efa5255b760722a2e39950d40f52a6e98cd3a221d017dcaa0041a1432f12d7350e267636c62614ff39e786cc24fce72e80e","ssdeep":"12288:rQh0HIc4o0Y3C5tfCsn9N9+I6gPIOVycGmIyrX:a0ocMY3C5tfCsT/G5yrX","ssdeep_chunks":["12288:rQh0HIc","12288:Qh0HIc4","12288:h0HIc4o","12288:0HIc4o0","12288:HIc4o0Y","12288:Ic4o0Y3","12288:c4o0Y3C","12288:4o0Y3C5","12288:o0Y3C5t","12288:0Y3C5tf","12288:Y3C5tfC","12288:3C5tfCs","12288:C5tfCsn","12288:5tfCsn9","12288:tfCsn9N","12288:fCsn9N9","12288:Csn9N9+","12288:sn9N9+I","12288:n9N9+I6","12288:9N9+I6g","12288:N9+I6gP","12288:9+I6gPI","12288:+I6gPIO","12288:I6gPIOV","12288:6gPIOVy","12288:gPIOVyc","12288:PIOVycG","12288:IOVycGm","12288:OVycGmI","12288:VycGmIy","12288:ycGmIyr","12288:cGmIyrX","24576:rQh0HIc","24576:Qh0HIc4","24576:h0HIc4o","24576:0HIc4o0","24576:HIc4o0Y","24576:Ic4o0Y3","24576:c4o0Y3C","24576:4o0Y3C5","24576:o0Y3C5t","24576:0Y3C5tf","24576:Y3C5tfC","24576:3C5tfCs","24576:C5tfCsn","24576:5tfCsn9","24576:tfCsn9N","24576:fCsn9N9","24576:Csn9N9+","24576:sn9N9+I","24576:n9N9+I6","24576:9N9+I6g","24576:N9+I6gP","24576:9+I6gPI","24576:+I6gPIO","24576:I6gPIOV","24576:6gPIOVy","24576:gPIOVyc","24576:PIOVycG","24576:IOVycGm","24576:OVycGmI","24576:VycGmIy","24576:ycGmIyr","24576:cGmIyrX","12288:a0ocMY3","12288:0ocMY3C","12288:ocMY3C5","12288:cMY3C5t","12288:MY3C5tf","12288:C5tfCsT","12288:5tfCsT/","12288:tfCsT/G","12288:fCsT/G5","12288:CsT/G5y","12288:sT/G5yr","12288:T/G5yrX"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"66b08c64b6cb50a8dff36d4e88c7dbdf546b941c"},"file_info":{"file_name":"TGMacro.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":969728,"entropy":6.32,"compile_timestamp":"2074-11-03T01:15:45","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777586413000,"last_seen":1787863823000,"last_multi_scan":1787863823000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":9,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":826836,"raw_size":826880},{"name":".rsrc","virtual_address":"0xcc000","virtual_size":141604,"raw_size":141824},{"name":".reloc","virtual_address":"0xf0000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":239,"suspicious_count":12,"malicious_count":4,"total":255},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"},{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\", Pattern match: \"https://trksyln.net\", Pattern match: \"https://discord.gg/gj5znt4aaw\", Pattern match: \"http://schemas.openxmlformats.org/markup-compatibility/2006\", Pattern match: \"https://gettgmacro.com/getstarted#actioneditor\", Pattern match: \"http://scripts.sil.org/oflthis\", Pattern match: \"https://gettgmacro.com\", Heuristic match: \"gettgmacro.com\", Heuristic match: \"%#developed by trksyln at trksyln.net\", Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\", Pattern match: \"http://www.w3.org/2001/xmlschema-instance\", Heuristic match: \"tj.er\", Heuristic match: \" 2024 gettgmacro.com\", Pattern match: \"https://gettgmacro.com/download/\", Heuristic match: \"trksyln.net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://trksyln.net\", Found HTTPS url \"https://discord.gg\", Found HTTPS url \"https://gettgmacro.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.0.51.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Trigger / Bind Key :\" (Indicator: \" bind \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"/TGMacro;component/usercontrols/actions/ucfindwindow.xaml\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \"usercontrols/actions/ucfindwindow.baml\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \",TGMacro.UI.UserControls.Actions.UCFindWindow\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \",TGMacro.UI.UserControls.Actions.UCFindWindow\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set / Clear\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set Key\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"The WS-Management service does not support the specified compression scheme (%1).\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"The only supported compression type is \"xpress\".\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"Change the value for the compression option and try the request again.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"<Input Sample.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595872'}\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595904'}\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595920'}\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LoadResource with parameter {'hModule': '77594625', 'hResInfo': '77595888'}\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"<HOOK MODULE=\"USER32.DLL\" FUNCTION=\"CallWindowProcW\"/>\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002480.00000000.156111.02A80000.00000004.mdmp\n 00000000-00002480.00000001.158032.02A80000.00000004.mdmp\n 00000000-00002480.00000002.159951.02A80000.00000004.mdmp\n 00000000-00002480.00000003.165464.02A80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin has big resource with name: \"fonts/armata-regular.ttf\" size: \"86256\" and abnormal entropy:\"6.46237837762985\"\n 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin has big resource with name: \"windows/main.baml\" size: \"13328\" and abnormal entropy:\"6.184378004732036\"\n 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin has big resource with name: \"costura.tgmacro.core.dll.compressed\" size: \"70824\" and abnormal entropy:\"7.99239658754341\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000000.156111.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000001.158032.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000002.159951.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000002.159951.073B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000003.165464.05B40000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.08810000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.08810000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.08810000.00000004.mdmp\")\n Found string - \\.\\pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG; Source: \"00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp\")\n Found string \"Validation of public key failed.\" (Indicator: \"public key\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 192159; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 239427; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 592315; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 670212; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 670714; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 700496; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 947702; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 248028; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 705358; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 723263; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 249824; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 667219; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002480-00000C2C-1401697571\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp\")\n Found string \"The credential consists of both Password and UserName being supplied together in a pair.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"VPN.UserName=<UserName/InterfaceName>\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002480-00000C2C-1401697571\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002480-00000C2C-1409233861\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002480-00000C2C-1407501523\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002480-00000C2C-1408765407\")\n Found reference to API \"WTSFreeMemoryW\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002480-00000C2C-1408765438\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002480-00000C2C-1400207454\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002480-00000C2C-1400207954\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002480-00000C2C-1449857856\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\"\n Found system information discovery API: \"142599328064,928,115,,GetMonitorInfoW,user32.dll,\"00:41:33.859\",RX=0,PX=0\" in \"00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"<Input Sample.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"<Input Sample.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"<Input Sample.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"<Input Sample.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"<Input Sample.exe\" called \"IsWow64Process\" with parameter \"2480\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"<Input Sample.exe\" called \"GetWindowTextW\" (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GetWindowTextW\" with parameter \"TGMacro - What's New?\" - (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GetWindowTextW\" with parameter \"TGMacro\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"<Input Sample.exe\" called \"GetActiveWindow\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"<Input Sample.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"<Input Sample.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000000000005c00000000006300000000000000010000007400140000009862a902000000000100000001000000000000002c000000b8b9aa0200000000140000000a000000000000000000000000006f008040aa0214000000000000000000000000000000000000000000000000006e0000000000670000006c006c00 (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name Performance Log Users (UID: 00000000-00002480)\n \"<Input Sample.exe\" called \"LookupAccountSidW\" with param Name Performance Monitor Users (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"<Input Sample.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowAction\" (Indicator: \"FindWindowA\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"FindWindowAction\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002480.00000001.158032.02A80000.00000004.mdmp\n 00000000-00002480.00000002.159951.02A80000.00000004.mdmp\n 00000000-00002480.00000003.165464.02A80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"SDL_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineArgs\" (Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"<Input Sample.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"<Input Sample.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\Documents\\TGMacro (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"<Input Sample.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgm\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"<Input Sample.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"trksyln.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"187.124.10.244:443\"\n \"142.251.219.14:443\"\n \"142.250.101.95:443\"\n \"142.251.45.3:443\"\n \"142.251.218.66:443\"\n \"142.251.156.119:443\"\n \"142.251.214.34:443\"\n \"142.251.218.110:443\"\n \"74.125.137.157:443\"\n \"172.217.12.99:443\"\n \"142.251.218.225:443\"\n \"142.251.219.34:443\"\n \"142.251.218.97:443\"\n \"150.171.109.185:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\tarik.saylan\\source\\repos\\trksyln\\TGUI\\TGMacro.UI\\obj\\x86\\Release\\TGMacro.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"The function \"%1\" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found reference to API \"The function: \"%1\" failed unexpectedly. GetLastError=%2!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found reference to API \"GetLastError: %2!d!.%n\" (Indicator: \"GetLastError\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"SDL_ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"FlashWindowEx\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed unmanaged function \"timeBeginPeriod\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed unmanaged function \"timeEndPeriod\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"\n Observed unmanaged function \"NtQueryTimerResolution\" in \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG\n Found string - \\.\\pipe\\dCFnyQv8rmlj36MRDW4sVd6ssHJG6fNY8KjHfAGhsslrzmQW0VJ0HJlqdcuH7iyvbf7FnjdRnYUIHdqSBdRn27NMnceZWgLpYC90edD1OiUPWXWbdefEqG","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70C40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72250000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74FF0000\n \"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73970000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72EE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"<Input Sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 746F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" was detected as \".NET\" and name: \"Library\"\n \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"analytics.google.com\"\n \"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"edgeassetservice.azureedge.net\"\n \"ep1.adtrafficquality.google\"\n \"ep2.adtrafficquality.google\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"fundingchoicesmessages.google.com\"\n \"gettgmacro.com\"\n \"googleads.g.doubleclick.net\"\n \"pagead2.googlesyndication.com\"\n \"stats.g.doubleclick.net\"\n \"tpc.googlesyndication.com\"\n \"trksyln.net\"\n \"www.google.com\"\n \"www.googleapis.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$41","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp\")\n file/memory contains long string(Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"<Input Sample.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpstrksyln.netprojectstgm-gaming-macro-tgmacroinstalled\" has type \"HTML document Unicode text UTF-8 text with very long lines (23010)\"- [targetUID: 00000000-00002480]\n \"settings.json\" has type \"Unicode text UTF-8 (with BOM) text with CRLF line terminators\"- Location: [C:\\settings.json]- [targetUID: 00000000-00002480]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"<Input Sample.exe\" queries basic process information of the \"C:\\8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin.exe\" (UID: 2480)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"<Input Sample.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"<Input Sample.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin.exe\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"<Input Sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"<Input Sample.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"<Input Sample.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"<Input Sample.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"<Input Sample.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"<Input Sample.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"<Input Sample.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"<Input Sample.exe\" writes file \"c:\\settings.json\"\n \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin.exe\" writes file \"c:\\settings.json\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002480-00000C2C-1449595271\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"fonts.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"uzwvG\"\n \"sn;mw~\"\n \"h-xNt4\"\n \"utkm4vv\"\n \"ywywu\"\n \"6@wtC\"r\nDv7M9(kh^9\", \"]y^uw\", \"iK2yk7h)+&i)e\", \"LcrZW\n\", \"z(^+^+im\", \"utkm4vv\", \"ywywu\", \"]y^uw\", \"zx\"'%}-zx\"\", \":IM8Nt\", \"m6N6\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"fonts.googleapis.com\" has high entropy\n Contacted domain: \"googleads.g.doubleclick.net\" has high entropy\n Contacted domain: \"analytics.google.com\" has high entropy\n Contacted domain: \"stats.g.doubleclick.net\" has high entropy\n Contacted domain: \"tpc.googlesyndication.com\" has high entropy\n Contacted domain: \"ep1.adtrafficquality.google\" has high entropy\n Contacted domain: \"ep2.adtrafficquality.google\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"pagead2.googlesyndication.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"$4d","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"187.124.10.244\" on port \"443\"\n HTTPS traffic to \"142.251.219.14\" on port \"443\"\n HTTPS traffic to \"142.250.101.95\" on port \"443\"\n HTTPS traffic to \"142.251.45.3\" on port \"443\"\n HTTPS traffic to \"142.251.218.66\" on port \"443\"\n HTTPS traffic to \"142.251.156.119\" on port \"443\"\n HTTPS traffic to \"142.251.214.34\" on port \"443\"\n HTTPS traffic to \"142.251.218.110\" on port \"443\"\n HTTPS traffic to \"74.125.137.157\" on port \"443\"\n HTTPS traffic to \"172.217.12.99\" on port \"443\"\n HTTPS traffic to \"142.251.218.225\" on port \"443\"\n HTTPS traffic to \"142.251.219.34\" on port \"443\"\n HTTPS traffic to \"142.251.218.97\" on port \"443\"\n HTTPS traffic to \"150.171.109.185\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00002480\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$50","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")\n Found string \"<add name=\"LocalSqlServer\" connectionString=\"data source=.\\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"<Input Sample.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"<Input Sample.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"<Input Sample.exe\" called \"GetComputerNameW\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"<Input Sample.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"<Input Sample.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"<Input Sample.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"<Input Sample.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"2b7b770\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp, 00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.073B0000.00000004.mdmp\")\n Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.073B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")\n Found reference to API \"SDL_GL_GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.05B40000.00000004.mdmp, 00000000-00002480.00000001.158032.05B40000.00000004.mdmp, 00000000-00002480.00000002.159951.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.05B40000.00000004.mdmp, 00000000-00002480.00000003.165464.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 5c3c2231b01a9b769b94962b73d0286d-60002f2-IOHelper~IsAdministrator","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00002480.00000000.156111.00252000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$56","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"<Input Sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"<Input Sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"HARDWAREINFORMATION.MEMORYSIZE\")\n \"<Input Sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"INSTALLEDDISPLAYDRIVERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"<Input Sample.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002480.00000000.156111.02A80000.00000004.mdmp, 00000000-00002480.00000001.158032.02A80000.00000004.mdmp, 00000000-00002480.00000002.159951.02A80000.00000004.mdmp, 00000000-00002480.00000003.165464.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002480.00000000.156111.6CF81000.00000020.mdmp, 00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00002480.00000001.158032.6CEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002480-00000C2C-1451036002\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002480.00000000.156111.00252000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002480.00000000.156111.00252000.00000002.mdmp\n 00000000-00002480.00000002.159951.0DD20000.00000002.mdmp\n Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00002480.00000002.159951.0DD20000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002480.00000000.156111.04B40000.00000004.mdmp, 00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002480.00000000.156111.6CF95000.00000002.mdmp, 00000000-00002480.00000002.159951.6CF31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"<Input Sample.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"DCFNYQV8RMLJ36MRDW4SVD6SSHJG6FNY8KJHFAGHSSLRZMQW0VJ0HJLQDCUH7IYVBF7FNJDRNYUIHDQSBDRN27NMNCEZWGLPYC90EDD1OIUPWXWBDEFEQG\"; Value: \"B009000000\")\n \"<Input Sample.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"<Input Sample.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002480.00000002.159951.098C0000.00000004.mdmp, 00000000-00002480.00000003.165464.098C0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Ellipse\" (Source: 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin, API is part of module: GDI32FULL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"<Input Sample.exe\" at 00000000-00002480-00000C15-1404399021","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"<Input Sample.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"<Input Sample.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2480)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"1F1-9C56-00505691BCD7}\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"System.Windows.FrameworkElement::FindResource(System.Object) at 5c3c2231b01a9b769b94962b73d0286d-60003dc-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 142.251.45.3\"\n \"UDP connection to 142.251.219.14\"\n \"UDP connection to 142.251.218.66\"\n \"UDP connection to 142.251.156.119\"\n \"UDP connection to 142.251.214.34\"\n \"UDP connection to 142.250.101.95\"\n \"UDP connection to 172.217.12.99\"\n \"UDP connection to 142.251.218.225\"\n \"UDP connection to 142.251.218.110\"\n \"UDP connection to 142.251.218.97\"\n \"UDP connection to 142.251.219.34\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Fody\" matched file \"sample.bin\" as \"Detects executables manipulated with Fody\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"PE_EVENTROOT\\CIMV2SCM EVENT PROVIDER\"\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002480.00000001.158032.08810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin\" claims program is from Sat Nov 3 01:15:45 2074","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"<Input Sample.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgm\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"0000000000\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"0000000000\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF00\")\n \"<Input Sample.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$5d","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"analytics.google.com\" with TTL 300\n \"clients2.googleusercontent.com\" with TTL 49\n \"edge-consumer-static.azureedge.net\" with TTL 152\n \"ep1.adtrafficquality.google\" with TTL 300\n \"ep2.adtrafficquality.google\" with TTL 300\n \"fonts.googleapis.com\" with TTL 300\n \"fonts.gstatic.com\" with TTL 300\n \"fundingchoicesmessages.google.com\" with TTL 300\n \"googleads.g.doubleclick.net\" with TTL 300\n \"pagead2.googlesyndication.com\" with TTL 300\n \"stats.g.doubleclick.net\" with TTL 300\n \"tpc.googlesyndication.com\" with TTL 300\n \"www.google.com\" with TTL 300\n \"www.googleapis.com\" with TTL 300\n \"www.gstatic.com\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003224.00000000.148692.038E0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003224.00000000.148692.038E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 365C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"TGMacro.exe\" called \"EnumWindows\" with parameter \"121827960\" - (UID: 00000000-00003224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"edgeassetservice.azureedge.net\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \",3195,,GetUserNameExW,secur3\" (Indicator: \"GetUserName\"; Source: \"00000000-00003224.00000001.150611.06090000.00000004.mdmp, 00000000-00003224.00000002.152533.06090000.00000004.mdmp, 00000000-00003224.00000003.159964.06090000.00000004.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp, 00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003224.00000002.152533.6D459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003224.00000001.150611.6D3BF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 18 domains and 18 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"intel_graph":{"map":{"Domain:analytics.google.com":{"type":"Domain","value":"analytics.google.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:edgeassetservice.azureedge.net":{"type":"Domain","value":"edgeassetservice.azureedge.net"},"Domain:ep1.adtrafficquality.google":{"type":"Domain","value":"ep1.adtrafficquality.google"},"Domain:ep2.adtrafficquality.google":{"type":"Domain","value":"ep2.adtrafficquality.google"},"Domain:fonts.googleapis.com":{"type":"Domain","value":"fonts.googleapis.com"},"Domain:fonts.gstatic.com":{"type":"Domain","value":"fonts.gstatic.com"},"Domain:fundingchoicesmessages.google.com":{"type":"Domain","value":"fundingchoicesmessages.google.com"},"Domain:gettgmacro.com":{"type":"Domain","value":"gettgmacro.com"},"Domain:googleads.g.doubleclick.net":{"type":"Domain","value":"googleads.g.doubleclick.net"},"Domain:pagead2.googlesyndication.com":{"type":"Domain","value":"pagead2.googlesyndication.com"},"Domain:stats.g.doubleclick.net":{"type":"Domain","value":"stats.g.doubleclick.net"},"Domain:tpc.googlesyndication.com":{"type":"Domain","value":"tpc.googlesyndication.com"},"Domain:trksyln.net":{"type":"Domain","value":"trksyln.net"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.googleapis.com":{"type":"Domain","value":"www.googleapis.com"},"Domain:www.gstatic.com":{"type":"Domain","value":"www.gstatic.com"},"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078":{"type":"File","value":"221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 12 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa":{"type":"File","value":"339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"image/vnd.microsoft.icon"},"File:35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b":{"type":"File","value":"35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b"},"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7":{"type":"File","value":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec":{"type":"File","value":"c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec"},"File:c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef":{"type":"File","value":"c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9600, cbSize 9654, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"Ip:13.107.226.51":{"type":"Ip","value":"13.107.226.51"},"Ip:142.250.101.95":{"type":"Ip","value":"142.250.101.95"},"Ip:142.251.156.119":{"type":"Ip","value":"142.251.156.119"},"Ip:142.251.210.225":{"type":"Ip","value":"142.251.210.225"},"Ip:142.251.210.234":{"type":"Ip","value":"142.251.210.234"},"Ip:142.251.214.34":{"type":"Ip","value":"142.251.214.34"},"Ip:142.251.218.110":{"type":"Ip","value":"142.251.218.110"},"Ip:142.251.218.170":{"type":"Ip","value":"142.251.218.170"},"Ip:142.251.218.225":{"type":"Ip","value":"142.251.218.225"},"Ip:142.251.218.65":{"type":"Ip","value":"142.251.218.65"},"Ip:142.251.218.66":{"type":"Ip","value":"142.251.218.66"},"Ip:142.251.218.97":{"type":"Ip","value":"142.251.218.97"},"Ip:142.251.219.14":{"type":"Ip","value":"142.251.219.14"},"Ip:142.251.219.34":{"type":"Ip","value":"142.251.219.34"},"Ip:142.251.45.3":{"type":"Ip","value":"142.251.45.3"},"Ip:150.171.109.184":{"type":"Ip","value":"150.171.109.184"},"Ip:150.171.109.185":{"type":"Ip","value":"150.171.109.185"},"Ip:172.217.12.99":{"type":"Ip","value":"172.217.12.99"},"Ip:187.124.10.244":{"type":"Ip","value":"187.124.10.244"},"Ip:2.18.67.149":{"type":"Ip","value":"2.18.67.149"},"Ip:74.125.137.157":{"type":"Ip","value":"74.125.137.157"},"Url:/adblock-check.js":{"type":"Url","value":"/adblock-check.js"},"Url:/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService":{"type":"Url","value":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService"},"Url:/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline":{"type":"Url","value":"/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline"},"Url:/chromewebstore/v1.1/items/verify":{"type":"Url","value":"/chromewebstore/v1.1/items/verify"},"Url:/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx":{"type":"Url","value":"/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx"},"Url:/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap":{"type":"Url","value":"/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap"},"Url:/css?family=Open%20Sans%3A300%2C400%2C500":{"type":"Url","value":"/css?family=Open%20Sans%3A300%2C400%2C500"},"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468":{"type":"Url","value":"/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468"},"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968":{"type":"Url","value":"/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968"},"Url:/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731":{"type":"Url","value":"/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731"},"Url:/googleads.js":{"type":"Url","value":"/googleads.js"},"Url:/i/pub-9495854422341365?ers=1":{"type":"Url","value":"/i/pub-9495854422341365?ers=1"},"Url:/manifest.json":{"type":"Url","value":"/manifest.json"},"Url:/mouse-gesture/config.json":{"type":"Url","value":"/mouse-gesture/config.json"},"Url:/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine":{"type":"Url","value":"/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine"},"Url:/old-site-content/images/adjust-timing.png":{"type":"Url","value":"/old-site-content/images/adjust-timing.png"},"Url:/old-site-content/images/multi-action.png":{"type":"Url","value":"/old-site-content/images/multi-action.png"},"Url:/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html":{"type":"Url","value":"/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html"},"Url:/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js":{"type":"Url","value":"/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js"},"Url:/projects/tgm-gaming-macro-tgmacro/installed":{"type":"Url","value":"/projects/tgm-gaming-macro-tgmacro/installed"},"Url:/projects/tgm-gaming-macro-tgmacro/installed/":{"type":"Url","value":"/projects/tgm-gaming-macro-tgmacro/installed/"},"Url:/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js":{"type":"Url","value":"/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js"},"Url:/sodar/sodar2.js":{"type":"Url","value":"/sodar/sodar2.js"},"Url:/sodar/sodar2/254/runner.html":{"type":"Url","value":"/sodar/sodar2/254/runner.html"},"Url:/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29":{"type":"Url","value":"/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29"},"Url:/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5"},"Url:/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5"},"Url:/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5"},"Url:/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5":{"type":"Url","value":"/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5"},"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js":{"type":"Url","value":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js"},"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js":{"type":"Url","value":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js"},"Url:/wp-content/plugins/gtranslate/flags/svg/en.svg":{"type":"Url","value":"/wp-content/plugins/gtranslate/flags/svg/en.svg"},"Url:/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1":{"type":"Url","value":"/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1"},"Url:/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js"},"Url:/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js"},"Url:/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js"},"Url:/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js"},"Url:/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js"},"Url:/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29"},"Url:/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29":{"type":"Url","value":"/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29"},"Url:/wp-content/uploads/2026/02/cropped-tgm-32x32.png":{"type":"Url","value":"/wp-content/uploads/2026/02/cropped-tgm-32x32.png"},"Url:/wp-content/uploads/2026/02/dotnetLogo.png":{"type":"Url","value":"/wp-content/uploads/2026/02/dotnetLogo.png"},"Url:/wp-content/uploads/2026/02/logo-1.png":{"type":"Url","value":"/wp-content/uploads/2026/02/logo-1.png"},"Url:/wp-content/uploads/2026/02/old-tgmacro-1.png":{"type":"Url","value":"/wp-content/uploads/2026/02/old-tgmacro-1.png"},"Url:/wp-includes/blocks/heading/style.min.css?ver=6.9.1":{"type":"Url","value":"/wp-includes/blocks/heading/style.min.css?ver=6.9.1"},"Url:/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1":{"type":"Url","value":"/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1"},"Url:/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1":{"type":"Url","value":"/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1"},"Url:/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375":{"type":"Url","value":"/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375"},"Url:/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0":{"type":"Url","value":"/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0"}},"chains":[{"id":"1542637439772793420","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1542637451296277363","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"memory","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078"},{"edge_kind":"extracted_from_archive","from_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078","to_key":"File:339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1542637451317248884","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"memory","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078"},{"edge_kind":"extracted","from_key":"File:221024d11fdc39a1f65bb72acf493bd226ffaff8f3f9804dd850cc3491f42078","to_key":"File:c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"sandbox_network","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:187.124.10.244"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.219.14"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.250.101.95"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.66"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.214.34"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.110"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:74.125.137.157"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:172.217.12.99"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.225"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.219.34"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.97"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:150.171.109.185"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.170"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:150.171.109.184"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.218.65"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.210.234"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:13.107.226.51"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:142.251.210.225"},{"edge_kind":"contacted_ip","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Ip:2.18.67.149"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:analytics.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:analytics.google.com","to_key":"Ip:142.251.218.110"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.218.65"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.184"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:edgeassetservice.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edgeassetservice.azureedge.net","to_key":"Ip:150.171.109.185"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:ep1.adtrafficquality.google"},{"edge_kind":"resolves_to","from_key":"Domain:ep1.adtrafficquality.google","to_key":"Ip:142.251.219.34"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:ep2.adtrafficquality.google"},{"edge_kind":"resolves_to","from_key":"Domain:ep2.adtrafficquality.google","to_key":"Ip:142.251.218.97"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:fonts.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.googleapis.com","to_key":"Ip:142.250.101.95"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:fonts.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.gstatic.com","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:fundingchoicesmessages.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:fundingchoicesmessages.google.com","to_key":"Ip:142.251.219.14"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:gettgmacro.com"},{"edge_kind":"resolves_to","from_key":"Domain:gettgmacro.com","to_key":"Ip:187.124.10.244"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:googleads.g.doubleclick.net"},{"edge_kind":"resolves_to","from_key":"Domain:googleads.g.doubleclick.net","to_key":"Ip:142.251.214.34"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:pagead2.googlesyndication.com"},{"edge_kind":"resolves_to","from_key":"Domain:pagead2.googlesyndication.com","to_key":"Ip:142.251.218.66"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:stats.g.doubleclick.net"},{"edge_kind":"resolves_to","from_key":"Domain:stats.g.doubleclick.net","to_key":"Ip:74.125.137.157"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:tpc.googlesyndication.com"},{"edge_kind":"resolves_to","from_key":"Domain:tpc.googlesyndication.com","to_key":"Ip:142.251.218.225"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:trksyln.net"},{"edge_kind":"resolves_to","from_key":"Domain:trksyln.net","to_key":"Ip:187.124.10.244"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:www.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.googleapis.com","to_key":"Ip:142.251.218.170"},{"edge_kind":"contacted_domain","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Domain:www.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.gstatic.com","to_key":"Ip:172.217.12.99"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/projects/tgm-gaming-macro-tgmacro/installed"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/projects/tgm-gaming-macro-tgmacro/installed/"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/adblock-check.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/blocks/heading/style.min.css?ver=6.9.1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/googleads.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/logo-1.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/old-site-content/images/adjust-timing.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/old-site-content/images/multi-action.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/old-tgmacro-1.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/dotnetLogo.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/gtranslate/flags/svg/en.svg"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/uploads/2026/02/cropped-tgm-32x32.png"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/manifest.json"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/i/pub-9495854422341365?ers=1"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/css?family=Open%20Sans%3A300%2C400%2C500"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/sodar/sodar2.js"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/sodar/sodar2/254/runner.html"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/chromewebstore/v1.1/items/verify"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/mouse-gesture/config.json"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx"},{"edge_kind":"contacted_url","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"Url:/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","edges":[{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef"},{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa"},{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b"},{"edge_kind":"extracted","from_key":"File:8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","to_key":"File:c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":264,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":21,"dns_resolutions_count":18,"contacted_urls_count":54,"http_requests_count":54},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69fbb24a72ad230fae00494d","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["USA"],"submit_name":"TGMacro.exe","analysis_start_time":"2026-05-06T21:27:40+00:00","indicators_count":{"informative":210,"suspicious":32,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"69f3d0f2728b2527ca09db69","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7.bin","analysis_start_time":"2026-04-30T22:00:19+00:00","indicators_count":{"informative":209,"suspicious":37,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"187.124.10.244","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"142.251.219.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.250.101.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.45.3","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.66","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.156.119","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.214.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"74.125.137.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"172.217.12.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.219.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"150.171.109.185","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"142.251.218.170","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"150.171.109.184","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.218.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"address":"142.251.210.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"13.107.226.51","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"142.251.210.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"address":"2.18.67.149","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}],"dns_resolutions":[{"domain":"analytics.google.com","address":"142.251.218.110","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"clients2.googleusercontent.com","address":"142.251.218.65","ttl":49,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.184","ttl":152,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"edgeassetservice.azureedge.net","address":"150.171.109.185","ttl":1446,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"ep1.adtrafficquality.google","address":"142.251.219.34","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"ep2.adtrafficquality.google","address":"142.251.218.97","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"fonts.googleapis.com","address":"142.250.101.95","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"fonts.gstatic.com","address":"142.251.45.3","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns4.google.com","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"fundingchoicesmessages.google.com","address":"142.251.219.14","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"gettgmacro.com","address":"187.124.10.244","ttl":1800,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"googleads.g.doubleclick.net","address":"142.251.214.34","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"pagead2.googlesyndication.com","address":"142.251.218.66","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"stats.g.doubleclick.net","address":"74.125.137.157","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"tpc.googlesyndication.com","address":"142.251.218.225","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"trksyln.net","address":"187.124.10.244","ttl":1800,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"www.google.com","address":"142.251.156.119","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"domain":"www.googleapis.com","address":"142.251.218.170","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"domain":"www.gstatic.com","address":"172.217.12.99","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"http_requests":[{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/projects/tgm-gaming-macro-tgmacro/installed","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /projects/tgm-gaming-macro-tgmacro/installed HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/projects/tgm-gaming-macro-tgmacro/installed/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /projects/tgm-gaming-macro-tgmacro/installed/ HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/adblock-check.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /adblock-check.js HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/main.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/page-title.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/cf-7.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/wpforms.min.css?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/blocks/heading/style.min.css?ver=6.9.1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/blocks/heading/style.min.css?ver=6.9.1 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/blocks/paragraph/style.min.css?ver=6.9.1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/blocks/paragraph/style.min.css?ver=6.9.1 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: text/css,*/*;q=0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: style\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/googleads.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /googleads.js HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/logo-1.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/2026/02/logo-1.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/old-site-content/images/adjust-timing.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /old-site-content/images/adjust-timing.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/old-site-content/images/multi-action.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /old-site-content/images/multi-action.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/old-tgmacro-1.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/2026/02/old-tgmacro-1.png HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: image\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/themes/blocksy/static/bundle/main.js?ver=2.1.29 HTTP/1.1\nHost: trksyln.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nReferer: https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: FCCDCF=%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%2281aca1b9-604a-4295-b76a-c0ba2a920803%5C%22%2C%5B1777611807%2C291000000%5D%5D%22%5D%5D%5D; FCNEC=%5Bnull%2Cnull%2C%5B%5B21%2C%22%5B%5B%5B%5B5%2C1%2C%5B0%5D%5D%2C%5B1777586461%2C486618000%5D%2C%5B1209600%5D%5D%5D%5D%22%5D%5D%5D","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0","method":"GET","response_code":"200","response_phrase":"OK","header":"$5f","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.5","method":"GET","response_code":"200","response_phrase":"OK","header":"$60","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/dotnetLogo.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$61","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-contact-form-7-83c32a029ed2cf5b6a82.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$62","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-events-provider-wpforms-08f4a4ca33532233b542.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$63","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/gtranslate/js/dwf.js?ver=6.9.1","method":"GET","response_code":"200","response_phrase":"OK","header":"$64","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/gtranslate/flags/svg/en.svg","method":"GET","response_code":"200","response_phrase":"OK","header":"$65","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/907.1390f43c75fed76e2bb4.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$66","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/plugins/blocksy-companion/static/bundle/sticky.js?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"$67","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/783.e17d921f2cfdf8fbd0b1.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$68","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/328.55362fd8fa2b20a85265.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$69","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/318.13f8c707f411eee1e7b5.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$6a","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/non-critical-styles.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"$6b","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/uploads/2026/02/cropped-tgm-32x32.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$6c","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/643.ddb47b33901d81e343c8.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$6d","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"trksyln.net","host_ip":"187.124.10.244:443","url":"/wp-content/themes/blocksy/static/bundle/back-to-top.min.css?ver=2.1.29","method":"GET","response_code":"200","response_phrase":"OK","header":"$6e","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"gettgmacro.com","host_ip":"187.124.10.244:443","url":"/manifest.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /manifest.json HTTP/1.1\nHost: gettgmacro.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"fundingchoicesmessages.google.com","host_ip":"142.251.219.14:443","url":"/i/pub-9495854422341365?ers=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /i/pub-9495854422341365?ers=1 HTTP/2\nHost: fundingchoicesmessages.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"fonts.googleapis.com","host_ip":"142.250.101.95:443","url":"/css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /css2?family=Baloo%20Paaji%202:wght@400;500;600;700&family=Open%20Sans:wght@700&display=swap HTTP/2\nHost: fonts.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0\nAccept: text/css,*/*;q=0.1\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: style","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"googleads.g.doubleclick.net","host_ip":"142.251.214.34:443","url":"/pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pagead/html/r20260428/r20190131/zrt_lookup_fy2021.html HTTP/2\nHost: googleads.g.doubleclick.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: navigate\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0, i\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: iframe","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"analytics.google.com","host_ip":"142.251.218.110:443","url":"/g/collect?v=2&tid=G-JH2MNQ1WXY>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&_p=1777611808096&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&gdid=dZTNiMT&_eu=AAAAAGAC&_prs=ok&are=1&cid=193386372.1777611973&frm=0&pscdl=noapi&rcb=7&sr=1280x800&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CMicrosoft%2520Edge%3B145.0.3800.58%7CChromium%3B145.0.7632.76&uam=&uamb=0&uap=Windows&uapv=5.0.0&uaw=0&ul=en-us&gaf=2&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1777611973&sct=1&seg=0&dl=https%3A%2F%2Ftrksyln.net%2Fprojects%2Ftgm-gaming-macro-tgmacro%2Finstalled%2F&dt=TGMacro%20Installed%20-%20trksyln&en=page_view&_fv=2&_nsi=1&_ss=2&_c=1&_ee=1&gap.plf=5&ep.googlesitekit_post_type=page&tfd=5968","method":"POST","response_code":"204","response_phrase":"No Content","header":"$6f","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"stats.g.doubleclick.net","host_ip":"74.125.137.157:443","url":"/g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468","method":"POST","response_code":"204","response_phrase":"No Content","header":"POST /g/collect?v=2&tid=G-JH2MNQ1WXY&cid=193386372.1777611973>m=45Pe64t1v9106823843za200zb9245232478zd9245232478&rcb=7&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=0~115616985~115938466~115938468 HTTP/2\nHost: stats.g.doubleclick.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://trksyln.net\nPriority: u=4, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"www.gstatic.com","host_ip":"172.217.12.99:443","url":"/recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /recaptcha/releases/dNfi_jsbkQb4Hbw7F1b82Uia/recaptcha__en.js HTTP/2\nHost: www.gstatic.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://trksyln.net/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://trksyln.net\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"www.gstatic.com","host_ip":"172.217.12.99:443","url":"/mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mysidia/da53a938dde6388ec020bb93d5cfadf9.js?tag=engine/client_fast/client_fast_engine HTTP/2\nHost: www.gstatic.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://googleads.g.doubleclick.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=1\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"tpc.googlesyndication.com","host_ip":"142.251.218.225:443","url":"/pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pagead/js/r20260428/r20110914/elements/html/ad_exit_monitor_fy2021.js HTTP/2\nHost: tpc.googlesyndication.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://googleads.g.doubleclick.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=1\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"fonts.googleapis.com","host_ip":"142.250.101.95:443","url":"/css?family=Open%20Sans%3A300%2C400%2C500","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /css?family=Open%20Sans%3A300%2C400%2C500 HTTP/2\nHost: fonts.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://googleads.g.doubleclick.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0\nAccept: text/css,*/*;q=0.1\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: style","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"ep1.adtrafficquality.google","host_ip":"142.251.219.34:443","url":"/getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /getconfig/sodar?sv=200&tid=gda&tv=r20260428&st=env&sjk=4338973945052731 HTTP/2\nHost: ep1.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://trksyln.net\nPriority: u=1, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"ep2.adtrafficquality.google","host_ip":"142.251.218.97:443","url":"/sodar/sodar2.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sodar/sodar2.js HTTP/2\nHost: ep2.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"ep2.adtrafficquality.google","host_ip":"142.251.218.97:443","url":"/sodar/sodar2/254/runner.html","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sodar/sodar2/254/runner.html HTTP/2\nHost: ep2.adtrafficquality.google\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: navigate\nSec-Fetch-Storage-Access: none\nReferer: https://trksyln.net/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=0, i\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: iframe","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.185:443","url":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"host":"www.googleapis.com","host_ip":"142.251.218.170:443","url":"/chromewebstore/v1.1/items/verify","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"host":"edge-consumer-static.azureedge.net","host_ip":"150.171.109.184:443","url":"/mouse-gesture/config.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"host":"clients2.googleusercontent.com","host_ip":"142.251.218.65:443","url":"/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2\nHost: clients2.googleusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-Os: Windows\nPriority: u=4, i\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Mesh-Client-Os-Version: 10.0.16299\nSec-Mesh-Client-Webview: 0\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.185:443","url":"/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: Shoreline\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}],"processes":[{"pid":3224,"ppid":0,"name":"TGMacro.exe","command_line":"","sha256":"8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7","normalized_path":"C:\\TGMacro.exe","uid":"00000000-00003224","icon":"$70"},{"pid":6616,"ppid":3224,"name":"msedge.exe","command_line":"--single-argument https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003224","uid":"00000000-00006616"},{"pid":1032,"ppid":6616,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x364,0x7ffd0bd50f18,0x7ffd0bd50f24,0x7ffd0bd50f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001032"},{"pid":8224,"ppid":6616,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1720,i,8814450797294355331,10032610730055576857,262144 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2104 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00008224"},{"pid":7688,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1892,i,1858545153825117560,4758857682127285089,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:11","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00007688"},{"pid":4596,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2116,i,10010501315732231390,13424116732742381265,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2176 /prefetch:13","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00004596"},{"pid":7028,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2330322414 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3004,i,1866185918622136700,16167826962713840860,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4104 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00007028"},{"pid":6744,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2330324055 --skip-read-main-dll --metrics-shmem-handle=3016,i,9181372239902383812,8184046871678290490,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4108 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00006744"},{"pid":2464,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4528,i,5448128650053341777,583670274115145665,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5080 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00002464"},{"pid":1672,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4316,i,13489898913158571514,1661112582528425057,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5060 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001672"},{"pid":5856,"ppid":6616,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=3184,i,11570198115862202173,16813546097020287979,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3120 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00006616","uid":"00000000-00005856"},{"pid":4588,"ppid":6616,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=3184,i,11570198115862202173,16813546097020287979,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3120 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00006616","uid":"00000000-00004588"},{"pid":1764,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5832,i,7570563531408359376,7230335218614014940,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5824 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001764"},{"pid":5028,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5964,i,13765849431814339412,6663383799659685917,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6052 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00005028"},{"pid":8196,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=6116,i,12858693893157619379,16878226534942736318,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3148 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00008196"},{"pid":1544,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2379981853 --skip-read-main-dll --metrics-shmem-handle=5264,i,10659766897055157679,9733051248876415938,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5280 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001544"},{"pid":2032,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2381015324 --skip-read-main-dll --metrics-shmem-handle=4672,i,495153001506454204,4105237748801229120,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4752 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00002032"},{"pid":9124,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4744,i,4054536528081378864,13639518459030648370,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6100 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00009124"},{"pid":1924,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3000,i,6917115033587507155,2548509711721284333,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5576 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001924"},{"pid":796,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5912,i,12114308830555372595,8341353276159015477,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=3000 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00000796"},{"pid":1960,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2428149867 --skip-read-main-dll --metrics-shmem-handle=4024,i,2397287714240374696,7878068228290979246,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6160 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00001960"},{"pid":6112,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6532,i,14262709906512488246,18396643434754687892,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6468 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00006112"},{"pid":3864,"ppid":6616,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=6556,i,13478401153754465102,6441270845239808381,262144 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6340 /prefetch:10","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00003864"},{"pid":2760,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6760,i,13097836676760220089,7551580370606422106,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=1248 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00002760"},{"pid":4696,"ppid":6616,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4964,i,3336943117137054302,15101183212494819842,524288 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6732 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00004696"},{"pid":6596,"ppid":6616,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --time-ticks-at-unix-epoch=-1778125946769070 --launch-time-ticks=2500286716 --skip-read-main-dll --metrics-shmem-handle=5116,i,16752142130302141466,4357991390836699079,2097152 --field-trial-handle=2168,i,2961945721650872909,863892790190567420,262144 --variations-seed-version --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5320 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006616","uid":"00000000-00006596"}],"all_imported_dlls":["oneauth.dll","mscms.dll","ResourcePolicyClient.dll","version.dll","OneCoreUAPCommonProxyStub.dll","dxgi.dll","onnxruntime.dll","wow64.dll","WindowsCodecs.dll","twinapi.appcore.dll","ncryptprov.dll","BitsProxy.dll","dxilconv.dll","win32u.dll","msvcrt.dll","PresentationFramework.ni.dll","Windows.Shell.ServiceHostBuilder.dll","GdiPlus.dll","ntasn1.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","sapi.dll","msasn1.dll","rmclient.dll","UIAutomationCore.dll","Windows.UI.dll","cldapi.dll","ffmpeg.dll","RTWorkQ.dll","System.Web.dll","dcomp.dll","CoreUIComponents.dll","mdmregistration.dll","dmcmnutils.dll","twinapi.dll","tbs.dll","ucrtbase.dll","imm32.dll","windows.storage.dll","ksuser.dll","d3d11.dll","ntmarta.dll","mswsock.dll","dsreg.dll","slc.dll","winnsi.dll","rometadata.dll","linkinfo.dll","dusmapi.dll","d3dcompiler_47.dll","kernel32.dll","bcryptprimitives.dll","shlwapi.dll","System.Windows.Forms.dll","ncryptsslp.dll","setupapi.dll","dbghelp.dll","D3D12.dll","msvcp140_clr0400.dll","shell32.dll","imagehlp.dll","ncrypt.dll","wwapi.dll","npmproxy.dll","rpcrt4.dll","PresentationCore.ni.dll","wtsapi32.dll","dpapi.dll","WindowsBase.ni.dll","PresentationNative_v0400.dll","SHCore.dll","d3d9.dll","msctfui.dll","rasapi32.dll","mskeyprotect.dll","Windows.Security.Authentication.Web.Core.dll","avrt.dll","wpfgfx_v0400.dll","MpOAV.dll","System.Web.Extensions.dll","nsi.dll","fltLib.dll","gdi32full.dll","System.Core.ni.dll","iertutil.dll","psapi.dll","TextInputFramework.dll","dnsapi.dll","msedge_elf.dll","combase.dll","ntdll.dll","sechost.dll","wininet.dll","DataExchange.dll","oleacc.dll","microsoft_shell_integration.dll","wevtapi.dll","gdi32.dll","vcruntime140_clr0400.dll","cfgmgr32.dll","MpClient.dll","WinTypes.dll","Windows.System.Profile.RetailInfo.dll","oneds.dll","mfplat.dll","apphelp.dll","mscorlib.ni.dll","bcrypt.dll","winsta.dll","UIAutomationTypes.dll","actxprxy.dll","wscapi.dll","user32.dll","ws2_32.dll","dwmapi.dll","comctl32.dll","UIAutomationProvider.dll","FirewallAPI.dll","Windows.Networking.Connectivity.dll","wow64win.dll","wow64cpu.dll","msvcp_win.dll","System.Xml.ni.dll","mscoree.dll","advapi32.dll","System.Drawing.dll","winmmbase.dll","mf.dll","VxSSL32.dll","webengine4.dll","wkscli.dll","schannel.dll","webauthn.dll","msacm32.dll","ole32.dll","gpapi.dll","System.Net.Http.ni.dll","msedge.dll","libEGL.dll","crypt32.dll","propsys.dll","devobj.dll","oleaut32.dll","mscoreei.dll","sppc.dll","Windows.Security.Authentication.OnlineId.dll","aepic.dll","wlanapi.dll","KernelBase.dll","powrprof.dll","wintrust.dll","LC696OlH.dll","d3d10warp.dll","winhttp.dll","FWPUCLNT.DLL","PCPKsp.dll","ucrtbase_clr0400.dll","uxtheme.dll","profapi.dll","wldp.dll","secur32.dll","MMDevAPI.dll","fwbase.dll","netprofm.dll","msctf.dll","edputil.dll","mlang.dll","nlaapi.dll","well_known_domains.dll","msdmo.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","telclient.dll","sspicli.dll","cryptsp.dll","clr.dll","amsi.dll","urlmon.dll","dhcpcsvc.dll","rasman.dll","rtutils.dll","cryptbase.dll","PresentationFramework.Aero2.ni.dll","netutils.dll","winmm.dll","CoreMessaging.dll","PresentationFramework-SystemXml.dll","rasadhlp.dll","KBDUS.DLL","kernel.appcore.dll","rsaenh.dll","clbcatq.dll","sxs.dll","atlthunk.dll","netapi32.dll","slwga.dll","domain_actions.dll","System.ni.dll","System.Xaml.ni.dll","directmanipulation.dll","vcruntime140.dll","libGLESv2.dll","vk_swiftshader.dll","clrjit.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","msvcp110_win.dll","Windows.UI.Immersive.dll","DWrite.dll","System.Configuration.ni.dll","userenv.dll","Accessibility.dll","directxdatabasehelper.dll","TenantRestrictionsPlugin.dll","TextShaping.dll","ExecModelClient.dll","AssignedAccessRuntime.dll","wow64con.dll","umpdc.dll","OneCoreCommonProxyStub.dll","Windows.StateRepositoryClient.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","omadmapi.dll","CorePrivacySettingsStore.dll","usermgrcli.dll","Windows.Internal.Shell.Broker.dll","CryptoWinRT.dll","Windows.StateRepositoryPS.dll","MicrosoftAccountWAMExtension.dll","execmodelproxy.dll","policymanager.dll","D3DSCache.dll","Y5k5eVE1.dll","mobilenetworking.dll","capauthz.dll","vcruntime140_1_app.dll","StateRepository.Core.dll","Windows.StateRepositoryCore.dll","InputHost.dll","TileDataRepository.dll","directml.dll","Windows.System.Launcher.dll","Windows.StateRepository.dll","vaultcli.dll","biwinrt.dll","ieframe.dll","aadWamExtension.dll","DiagnosticDataSettings.dll","windowsudk.shellcommon.dll","xmllite.dll","wow64base.dll","StartTileData.dll","AppXDeploymentClient.dll","StartMenu.dll","vcruntime140_app.dll","D3D12Core.dll","DXCore.dll","Windows.Web.dll","Windows.ApplicationModel.dll","nlansp_c.dll","UserMgrProxy.dll","srvcli.dll","Windows.Storage.ApplicationData.dll","msvcp140_app.dll","wpnapps.dll","AppResolver.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef","sha256":"c05ee3e305375af5638b4f5c2354a1e22e1583dcc508ed0169cb16b6b6bbd2ef","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa","sha256":"339dce7c27015bbad632d71dc3db92db01d4b1f5bb30c742fc5974ea4c16c8aa","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"settings.json","sha256":"35afdac5b5bd312474a13c598ffd977ad5ad2c2871fb279469b0de207004215b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"urlref_httpstrksyln.netprojectstgm-gaming-macro-tgmacroinstalled","sha256":"c04df9d8c143f3811ae9bceecad864f6cd099fab6c4bd75bc5003509bd87aaec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"C:\\settings.json","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\trksyln-TMACRO","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Local\\SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Local\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"trksyln-TMACRO","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"SM0:2480:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"69f3d0f2728b2527ca09db69"},{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"Local\\SM0:3224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]},{"name":"Local\\SM0:3224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69fbb24a72ad230fae00494d"}]}]}},"report_ids":{"sandbox_job_ids":["69f3d0f2728b2527ca09db69","69fbb24a72ad230fae00494d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 8d0c5274aa4f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8d0c5274aa4f…. Threat score 85/100. 0/25 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L71","11",{}]] </article></body></html>