24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Generik.HYARHHI trojan Sample 02cbc77d52e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 02cbc77d52e1…. Malware family: Generik.HYARHHI trojan. Threat score 100/100. 1/25 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c","keywords":["Malicious","Generik.HYARHHI trojan","malware analysis","sandbox report","threat intelligence","02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c"],"about":{"@type":"SoftwareApplication","name":"02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin","applicationCategory":["compressed","innosetup"],"identifier":"02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Generik.HYARHHI trojan","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1840,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")26:Tf5d,Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "?SuspendThreadsInCurrentProcess@BugSplatImp@@QEAAXXZ" (Indicator: "SuspendThread"; Source: "00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlWow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlWow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlWow64SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")27:T55e,Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")28:T1c9a,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")29:T7be,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")2a:Taee,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004760.00000000.166744.3B7AF000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004760.00000000.166744.3B80A000.00000002.mdmp, 00000000-00004760.00000000.166744.7711F000.00000002.mdmp, 00000000-00004760.00000000.166744.77278000.00000002.mdmp, 00000000-00004760.00000000.166744.7B86B000.00000002.mdmp, 00000000-00004760.00000000.166744.80065000.00000002.mdmp, 00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "CreateReportThreaded LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004760.00000000.166744.80065000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004760.00000000.166744.D2AAA000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")2b:T47a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.D2520000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004760.00000000.166744.77248000.00000002.mdmp, 00000000-00004760.00000000.166744.D2520000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")2c:T42c,"fd;ig2xjk7*lp0uxhjyct[cfgc8gdigicert," - Source: "00000000-00008112.00000000.166588.010EE000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0oc,acu@+rb^wlkm'0" - Source: "00000000-00008112.00000000.166588.010EE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00008112.00000001.166768.010EE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00008112.00000001.166768.010EE000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0*9z9ndo>fd;ig2xjk7*lp0uxhjyct[cfgc8gdigicert," - Source: "00000000-00008112.00000001.166768.010EE000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0oc,acu@+rb^wlkm'0" - Source: "00000000-00008112.00000001.166768.010EE000.00000004.mdmp") Found URL "http://crl3.digicert.com/digiw" - Source: "00000000-00008112.00000001.166768.010EE000.00000004.mdmp") Found URL "http://www.digicert.com/cps0" - Source: "00000000-00008112.00000001.166768.010EE000.00000004.mdmp")54:T7e1,Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")55:T7c3,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp")56:Te2d,Found registry query API: "RegQueryValueExW" in file "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin" Found registry query API: "RegOpenKeyExW" in file "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c.bin" Found registry query API: "RegOpenKeyEx" in file "00000000-00008112.00000000.166588.00401000.00000020.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00004760.00000000.166744.80065000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00004760.00000000.166744.80065000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004760.00000000.166744.80065000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004760.00000000.166744.80065000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004760.00000000.166744.80065000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004760.00000000.166744.80065000.00000002.mdmp" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00004760.00000000.166744.DA07A000.00000004.mdmp, 00000000-00004760.00000000.166744.DA440000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00008112.00000000.166588.00401000.00000020.mdmp"57:T514,"