24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Midie.Generic Sample 0d3928bbe9db… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0d3928bbe9db…. Malware family: Midie.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1","keywords":["Malicious","Midie.Generic","malware analysis","sandbox report","threat intelligence","0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Midie.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e6,"file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001977203559029c01590200005902e21483735505000017003800040000003b021c77cb901977d013837358a15b022c1483739b9019778ce91800203559020000ad740000837310000000e8000000e800ad7400000000f8e8180030775902c4e918004558207720355902fc01000000000000db9019770000ad740000000058158373e800ad74e8e81800e8000000c4e91800455820774fc61a00feffffff3b021c77750a1d7720355902661583732c148300def51b771790197710ea18000000837300008373920a1d777b901977e8000000e800837300000000dcea180001000000 (UID: 00000000-00005028) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005028)26:T6b7,"file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005028) "file.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00005028)27:T474d,Found reference to API (Indicator: "GetStdHandle"; File: "file") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "GetConsoleMode"; File: "file") Found reference to API (Indicator: "GetLocaleInfoA"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "CommConfigDialogA"; File: "file") Found reference to API (Indicator: "SetStdHandle"; File: "file") Found reference to API (Indicator: "GetCPInfo"; File: "file") Found reference to API (Indicator: "GetStringTypeA"; File: "file") Found reference to API (Indicator: "ZombifyActCtx"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "HeapReAlloc"; File: "file") Found reference to API (Indicator: "GetStringTypeW"; File: "file") Found reference to API (Indicator: "WriteConsoleOutputW"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "TlsAlloc"; File: "file") Found reference to API (Indicator: "IsDebuggerPresent"; File: "file") Found reference to API (Indicator: "HeapAlloc"; File: "file") Found reference to API (Indicator: "VerLanguageNameW"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "EnumCalendarInfoA"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "InterlockedDecrement"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "WriteConsoleA"; File: "file") Found reference to API (Indicator: "SetCommBreak"; File: "file") Found reference to API (Indicator: "RtlCaptureContext"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "InterlockedIncrement"; File: "file") Found reference to API (Indicator: "WriteConsoleW"; File: "file") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "file") Found reference to API (Indicator: "HeapFree"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "SetHandleCount"; File: "file") Found reference to API (Indicator: "LoadLibraryW"; File: "file") Found reference to API (Indicator: "GetOEMCP"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "CallNamedPipeA"; File: "file") Found reference to API (Indicator: "FlushFileBuffers"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "RtlUnwind"; File: "file") Found reference to API (Indicator: "GetStartupInfoA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GetConsoleAliasesA"; File: "file") Found reference to API (Indicator: "GetProcessHeap"; File: "file") Found reference to API (Indicator: "CompareStringW"; File: "file") Found reference to API (Indicator: "FindFirstFileExA"; File: "file") Found reference to API (Indicator: "OpenJobObjectW"; File: "file") Found reference to API (Indicator: "GetFileType"; File: "file") Found reference to API (Indicator: "TlsSetValue"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "BuildCommDCBA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "FlushConsoleInputBuffer"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "GetConsoleCP"; File: "file") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; File: "file") Found reference to API (Indicator: "LCMapStringA"; File: "file") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "HeapSize"; File: "file") Found reference to API (Indicator: "GetCommandLineA"; File: "file") Found reference to API (Indicator: "SetConsoleTitleW"; File: "file") Found reference to API (Indicator: "TlsFree"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "VirtualUnlock"; File: "file") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableA"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "GetACP"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "GetLongPathNameW"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "IsValidCodePage"; File: "file") Found reference to API (Indicator: "HeapCreate"; File: "file") Found reference to API (Indicator: "VirtualFree"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "VirtualAlloc"; File: "file") Found reference to API (Indicator: "UpdateWindow"; File: "file") Found reference to API (Indicator: "EncodePointer"; File: "file") Found reference to API (Indicator: "DecodePointer"; File: "file") Found reference to API (Indicator: "FlsFree"; File: "file") Found reference to API (Indicator: "FlsSetValue"; File: "file") Found reference to API (Indicator: "FlsGetValue"; File: "file") Found reference to API (Indicator: "FlsAlloc"; File: "file") Found reference to API (Indicator: "GetProcessWindowStation"; File: "file") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "file") Found reference to API (Indicator: "GetLastActivePopup"; File: "file") Found reference to API (Indicator: "GetActiveWindow"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "EnumCalendarInfoA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "CommConfigDialogA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "CallNamedPipeA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleOutputW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "ZombifyActCtx"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "FlushConsoleInputBuffer"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetCommBreak"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleAliasesA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "VirtualUnlock"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "OpenJobObjectW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "BuildCommDCBA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp")28:T4bd,"150016003cda877384ed18002e028673@ADVAPI32.dll" "0e000f00ecda877384ed18002e028673@ADVAPI32.dll" "0e000f0048db877384ed18002e028673@ADVAPI32.dll" "1100120024e3877384ed18002e028673@ADVAPI32.dll" "11001200c0e3877384ed18002e028673@ADVAPI32.dll" "1200130004e4877384ed18002e028673@ADVAPI32.dll" "120013005ce4877384ed18002e028673@ADVAPI32.dll" "140015008005887384ed18002e028673@ADVAPI32.dll" "140015009805887384ed18002e028673@ADVAPI32.dll" "14001500b005887384ed18002e028673@ADVAPI32.dll" "17001800c805887384ed18002e028673@ADVAPI32.dll" "0d000e00e005887384ed18002e028673@ADVAPI32.dll" "0f0010000c07887384ed18002e028673@ADVAPI32.dll" "140015004c07887384ed18002e028673@ADVAPI32.dll" "140015006407887384ed18002e028673@ADVAPI32.dll" "0c000d00ac07887384ed18002e028673@ADVAPI32.dll" "0c000d00bc07887384ed18002e028673@ADVAPI32.dll" "0e000f00cc07887384ed18002e028673@ADVAPI32.dll" "180019003409887384ed18002e028673@RPCRT4.dll" "130014006009887384ed18002e028673@RPCRT4.dll" "140015007409887384ed18002e028673@RPCRT4.dll" "160017008c09887384ed18002e028673@RPCRT4.dll" "0b000c000402887384ed18002e028673@WS2_32.dll" "150016003cda87734cf518002e028673@ADVAPI32.dll" "0e000f00ecda87734cf518002e028673@ADVAPI32.dll"29:T697,"file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "")2a:Ta36,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")2b:T4fe,"file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "file.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "file.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "file.exe" trying to touch file "C:\FLTLIB.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "file.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "file.exe" trying to touch file "C:\msimg32.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\msimg32.dll" "file.exe" trying to touch file "C:\msvcr100.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\msvcr100.dll" "file.exe" trying to touch file "C:\Windows\System32\wow64.dll"2c:T4ba,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005028.00000000.169825.0040B000.00000002.mdmp")2d:T21c5,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76CE3000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "DbgUiWaitWaitStateChange: DbgCreateThreadWaitStateChange" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")2e:T418,Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")2f:T6ba,Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")30:T32e2,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.73E68000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.758FB000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76584000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.73E68000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.758FB000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76584000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76621000.00000020.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")31:Te2b,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")32:T68d,Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "CpuNotifyUnmapViewOfSection(%p) called" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "BTCpuNotifyUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")33:T4ef,Found program location discovery API: "__p__pgmptr" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp" Found program location discovery API: "__p__wpgmptr" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp" Found program location discovery API: "_get_pgmptr" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp" Found program location discovery API: "_get_wpgmptr" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp" Found program location discovery API: "_pgmptr" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp" Found program location discovery API: "_wpgmptr" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp"34:T93a,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76621000.00000020.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwQuerySystemInformationEx" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQuerySystemInformation: Called with unsupported class %x." (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "NtQuerySystemInformationEx: Called with unsupported class %x." (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")35:T6ea,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76621000.00000020.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "NtQuerySystemInformation: Called with unsupported class %x." (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found string "NtQuerySystemInformationEx: Called with unsupported class %x." (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")36:T612,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")37:T7f6,Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAllocateAndInitializeSidEx" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")38:T1152,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76584000.00000002.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")39:T994,Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")3a:T25a4,Found system information discovery API: "GetEnvironmentStrings" in file "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1" Found system information discovery API: "GetEnvironmentStringsW" in file "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1" Found system information discovery API: "GetUserObjectInformationA" in file "0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp" Found system information discovery API: "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76621000.00000020.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformationEx" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "NtWow64GetNativeSystemInformation" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.6489D000.00000002.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76621000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76B31000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "ZwWow64GetNativeSystemInformation" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation: Called with unsupported class %x." in "00000000-00004780.00000000.190040.64914000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformationEx: Called with unsupported class %x." in "00000000-00004780.00000000.190040.64914000.00000002.mdmp" Found system information discovery API: "NtWow64GetNativeSystemInformation: Called with unsupported class %x." in "00000000-00004780.00000000.190040.64914000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.75631000.00000020.mdmp, 00000000-00004780.00000000.190040.75761000.00000020.mdmp, 00000000-00004780.00000000.190040.76711000.00000020.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.75761000.00000020.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.73E68000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.76CE3000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp"3b:T9d3,Found string "SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_FAN" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_CACHEMEMORY" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PHYSICALMEMORY" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYDEVICE" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYARRAY" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_VOLTAGEPROBE" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PORTCONNECTOR" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_SMBIOSMEMORY" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_MEMORY" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_NUMERICSENSOR" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_PHYSICALCONNECTOR" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_SENSOR" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_SLOT" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_TEMPERATURESENSOR" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM CIM_VOLTAGESENSOR" (Indicator: "select * from "; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp")3c:T10df,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")3d:T45c,Found reference to API "NtQueryVolumeInformationFile" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwQueryVolumeInformationFile" (Indicator: "ZwQueryVolumeInformationFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQueryVolumeInformationFile: called with unsupported class : %lx" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")3e:T550,Found string "GetCommandLineA" (Source: "00000000-00004780.00000000.190040.0040B000.00000002.mdmp, 00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")3f:Ta18,"SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from msacpi_thermalzonetemperature") "SELECT * FROM WIN32_FAN" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_fan") "SELECT * FROM WIN32_CACHEMEMORY" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_cachememory") "SELECT * FROM WIN32_PHYSICALMEMORY" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_physicalmemory") "SELECT * FROM WIN32_MEMORYDEVICE" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_memorydevice") "SELECT * FROM WIN32_MEMORYARRAY" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_memoryarray") "SELECT * FROM WIN32_VOLTAGEPROBE" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_voltageprobe") "SELECT * FROM WIN32_PORTCONNECTOR" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_portconnector") "SELECT * FROM WIN32_SMBIOSMEMORY" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_smbiosmemory") "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from win32_perfformatteddata_counters_thermalzoneinformation") "SELECT * FROM CIM_MEMORY" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_memory") "SELECT * FROM CIM_NUMERICSENSOR" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_numericsensor") "SELECT * FROM CIM_PHYSICALCONNECTOR" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_physicalconnector") "SELECT * FROM CIM_SENSOR" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_sensor") "SELECT * FROM CIM_SLOT" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_slot") "SELECT * FROM CIM_TEMPERATURESENSOR" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_temperaturesensor") "SELECT * FROM CIM_VOLTAGESENSOR" (Source: 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, Indicator: "select * from cim_voltagesensor")40:Tce6,Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "DbgUiWaitWaitStateChange: DbgCreateProcessWaitStateChange" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")41:T8e2,Found reference to API "NtCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.76584000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp")42:T9d9,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.739E5000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")43:T1876,Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "FindResourceEx API entry" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LoadResource API exit" (Indicator: "LoadResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72F6F000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")44:T424,Found reference to API "NtOpenEvent" (Indicator: "NtOpenEvent"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenEventPair" (Indicator: "NtOpenEvent"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenEvent" (Indicator: "ZwOpenEvent"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenEventPair" (Indicator: "ZwOpenEvent"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")45:T2132,Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D56000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Wow64SuspendLocalThread : NtResumeThread failed %lx" (Indicator: "ResumeThread"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "Wow64SuspendLocalThread : NtSuspendThread failed %lx" (Indicator: "SuspendThread"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "DbgUiWaitWaitStateChange: DbgCreateThreadWaitStateChange" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "RtlWow64SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763AB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")46:T23b5,"\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.768B0000.00000002.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.768B0000.00000002.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77121000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.75631000.00000020.mdmp 00000000-00004780.00000000.190040.768B0000.00000002.mdmp 00000000-00004780.00000000.190040.77121000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.75631000.00000020.mdmp 00000000-00004780.00000000.190040.768B0000.00000002.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77121000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Wow64\" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "\REGISTRY\USER\*\SOFTWARE\Classes" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "\REGISTRY\USER\*\SOFTWARE\Classes\Wow6432Node" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp47:Tc312,"\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Wow64\" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "\REGISTRY\USER\*\SOFTWARE\Classes" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "\REGISTRY\USER\*\SOFTWARE\Classes\Wow6432Node" in Source: 00000000-00004780.00000000.190040.64914000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider" in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\" in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type " in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types" in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Providers\Type " in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3" in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\8A334AA8052DD244A647306A76B8178FA215F344" in Source: 00000000-00004780.00000000.190040.72F61000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Software\Classes\CLSID\" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Disable8And16BitMitigation" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" in Source: 00000000-00004780.00000000.190040.73D61000.00000020.mdmp "System\CurrentControlSet\Control\SecurityProviders" in Source: 00000000-00004780.00000000.190040.73D61000.00000020.mdmp "System\CurrentControlSet\Control\Lsa\SspiCache" in Source: 00000000-00004780.00000000.190040.73D61000.00000020.mdmp "System\CurrentControlSet\Control\SecurityProviders\SaslProfiles" in Source: 00000000-00004780.00000000.190040.73D61000.00000020.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00004780.00000000.190040.73D61000.00000020.mdmp "System\CurrentControlSet\Control\Hvsi" in Source: 00000000-00004780.00000000.190040.73D61000.00000020.mdmp "SOFTWARE\Microsoft\Ole\Extensions" in Source: 00000000-00004780.00000000.190040.75477000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\GpParameters" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Software\Policies\Microsoft\Windows\Safer" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "System\CurrentControlSet\Control\IDConfigDB" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\Software\Classes" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "System\CurrentControlSet\Control\LSA\AccessProviders" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\SrpExtensionConfig" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "System\CurrentControlSet\Services\" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\CLASSES" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "Software\Classes\" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00004780.00000000.190040.75631000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout\" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Display" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\Tablet PC\" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Media Center\" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "Software\Policies\Microsoft\Windows NT\Reliability" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\" in Source: 00000000-00004780.00000000.190040.75761000.00000020.mdmp "System\CurrentControlSet\Control\Power\User\Default\PowerSchemes" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "System\CurrentControlSet\Control\Power\PowerSettings" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "System\CurrentControlSet\Control\Power\User\PowerSchemes" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "System\CurrentControlSet\Policies\Microsoft\PortableOperatingSystem" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "System\CurrentControlSet\Services\NDIS\Parameters" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "System\CurrentControlSet\Control\Power\ModernSleep" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.75AB1000.00000020.mdmp "SOFTWARE\Microsoft\OLEAUT" in Source: 00000000-00004780.00000000.190040.75B01000.00000020.mdmp "SOFTWARE\Microsoft\OLEAUT\UserEra" in Source: 00000000-00004780.00000000.190040.75B01000.00000020.mdmp "Software\Microsoft\OleAut" in Source: 00000000-00004780.00000000.190040.75B01000.00000020.mdmp "Software\classes" in Source: 00000000-00004780.00000000.190040.75B01000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "s\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Command Processor" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\CTF" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppHost" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\ClosedCaptioning" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Shell Extensions" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\WinTrust" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows NT" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ICM" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Wisp" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Policies" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Holographic" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\SystemCertificates" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Speech_OneCore" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Speech" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "Software\Microsoft\Speech Virtual" in Source: 00000000-00004780.00000000.190040.761E1000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00004780.00000000.190040.76391000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry\DontShowMeThisDialogAgain" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\Shell" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\Shell\MuiCache" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\classes" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Classes\Applications\%s" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Classes\Applications" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Clients\%s" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Clients\%s\%s" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Classes\" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows NT\Current Version" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "SOFTWARE\Microsoft\Internet Explorer\Registration" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\DeskView" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies\" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" in Source: 00000000-00004780.00000000.190040.763C1000.00000020.mdmp "Software\Classes" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "SOFTWARE\Microsoft\Ole\Extensions" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface\%s\TypeLib" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface\%s\Forward" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Registry\Machine\Software\Classes\" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\Ole" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "\Registry\Machine\Software\Classes\TypeLib\%s" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\OLE\Tracing" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\Ole\AppCompat" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\OLE2\UnknownUserType" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\OLE2\DefaultIconLabel" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\OLE1\UnregisteredVerb" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\OLE" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.76411000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "System\CurrentControlSet\Control\Hvsi" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FCM\Impolite" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\%s" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\%s" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\QfePolicyDefinitions\%s\%s" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "Software\Policies\Microsoft\Windows" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileInUseResolver" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00004780.00000000.190040.76621000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\WOW" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Quirks" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\CallbackDlls" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\Sorting\Ids" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\Containers" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\LanmanServer\Parameters" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\DnsCache\Parameters" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\WinInit" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\AppCompat" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\WOW" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ComputerName" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00004780.00000000.190040.768B0000.00000002.mdmp "Software\Microsoft\Rpc\SecurityService" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "Software\Microsoft\Rpc" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "System\CurrentControlSet\Services\Rpc\Linkage" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "System\CurrentControlSet\Services\Rpc" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "Software\Policies\Microsoft\Windows NT\Rpc" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Rpc\Extensions" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "System\CurrentControlSet\Control\SecurityProviders" in Source: 00000000-00004780.00000000.190040.76911000.00000020.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\GpParameters" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "Software\Microsoft\IdentityStore\Providers" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "\REGISTRY\MACHINE\Software\Microsoft\SecurityManager\TransientObjects\" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "System\CurrentControlSet\Control\SQMServiceList" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "System\CurrentControlSet\Control" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\WMI\Security" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00004780.00000000.190040.76A71000.00000020.mdmp "System\CurrentControlSet\Services\WinSock2\Parameters" in Source: 00000000-00004780.00000000.190040.76AC1000.00000020.mdmp "System\CurrentControlSet\Services\Winsock2\Parameters" in Source: 00000000-00004780.00000000.190040.76AC1000.00000020.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00004780.00000000.190040.76AC1000.00000020.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters" in Source: 00000000-00004780.00000000.190040.76AC1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services\WS2IFSL" in Source: 00000000-00004780.00000000.190040.76AC1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows NT\Printers" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Type 1 Fonts" in Source: 00000000-00004780.00000000.190040.76B31000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Cryptography\ECCParameters" in Source: 00000000-00004780.00000000.190040.76C91000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration" in Source: 00000000-00004780.00000000.190040.76C91000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00004780.00000000.190040.76C91000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" in Source: 00000000-00004780.00000000.190040.76C91000.00000020.mdmp "Software\Microsoft\Internet Explorer\International" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\URL\Prefixes" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Policies\Microsoft\Control Panel\International\Calendars\TwoDigitYearMax" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\MuiCache" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Classes" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\Origins" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\System" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Wow64\x86\xtajit" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\ImmutableMuiCache" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\%s" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\%s\%s" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "HKEY_USERS\...UserSid..." in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "HKEY_USERS\...UserSid...\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "HKEY_USERS\...UserSid...\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\...PackageFamilyName..." in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "HKEY_USERS\...UserSid...\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\...family..." in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Packages\Applications" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Packages\Applications\ContentUriRules" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Open:Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppX\PackageVolumes\%u" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppX" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Mappings" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ComputerName" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\CLASSES" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "Software\Classes\" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00004780.00000000.190040.77121000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\DevQuery" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\DeviceInstall\Parameters" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\DeviceInstall" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "System\CurrentControlSet\Control\IDConfigDB" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current" in Source: 00000000-00004780.00000000.190040.77301000.00000020.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004780.00000000.190040.77341000.00000020.mdmp48:T714,Found reference to API "LdrLoadDll" (Indicator: "LdrLoadDll"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrGetDllHandleEx" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrGetDllHandle" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.76603000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrGetDllHandleByMapping" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "LdrGetDllHandleByName" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")49:T47a,Found reference to API "NtQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")4a:T12cd,Found reference to API "Inspecting leaks at process shutdown ..." (Indicator: " shutdown "; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "The computer WAS able to connect on a secondary transport." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "The system bios failed to connect a system interrupt to the device or bus for which the device is connected." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product." (Indicator: " shutdown "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Please shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Please click OK to shutdown the system. You can use the recovery console to diagnose the system further." (Indicator: " shutdown "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "A system shutdown is in progress." (Indicator: " shutdown "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "You can't connect to the file share because it's not secure. This share requires the obsolete SMB1 protocol, which is unsafe and could expose your system to attack." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Indicates that there was an AuthIP failure when attempting to connect to the remote host." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "The requested connect mode conflicts with an existing mode on one or more of the specified pins." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "An attempt has been made to connect to a session whose video mode is not supported by the current client." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "The client failed to respond to the server connect message." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Your request to connect to this Terminal server has been rejected." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Windows can't connect to your session because a problem occurred in the Windows video subsystem. Try connecting again later, or contact the server administrator for assistance." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found reference to API "Specified VidPN source cannot be used because there is no available VidPN target to connect it to." (Indicator: " connect "; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp")4b:T5aa,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=228610" - Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851152" - Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=852747the" - Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004780.00000000.190040.73CB1000.00000020.mdmp") Found URL "http://www.w3.org/xml/1998/namespaceindexed\settings\xpathopenmetadatakeyinxmlattributeopenmetadatavalueoverridetextcontentadditionalcontentbinarycontenttargetnamespace=" - Source: "00000000-00004780.00000000.190040.763C1000.00000020.mdmp") Found URL "http://software\microsoft\windows\currentversion\url\defaultprefix%hs(%d)\%hs!%p:" - Source: "00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=228610" - Source: "00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851152" - Source: "00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=852747the" - Source: "00000000-00004780.00000000.190040.77459000.00000002.mdmp")4c:T7e1,Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp")4d:Taef,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76B0C000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")4e:T17bd,Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.76CE3000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry query API: "NtEnumerateValueKey: called with unsupported class : %lx" in "00000000-00004780.00000000.190040.64914000.00000002.mdmp" Found registry query API: "NtQueryKey: called with unsupported class : %lx" in "00000000-00004780.00000000.190040.64914000.00000002.mdmp" Found registry query API: "NtEnumerateKey: called with unsupported class : %lx" in "00000000-00004780.00000000.190040.64914000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.75631000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp"4f:T5d4,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004780.00000000.190040.04910000.00000004.mdmp") file/memory contains long string with (Indicator: "BitBlt"; Source: "00000000-00004780.00000000.190040.6489D000.00000002.mdmp")50:T4ae,Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.75B87000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")51:T60b,Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwReadFile" (Indicator: "ZwReadFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")52:T419,Found reference to API "CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtWow64CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwWow64CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "whNtWow64CsrGetProcessId(468) placeholder:" (Indicator: "GetProcessId"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "whNtWow64CsrGetProcessId(468) end: RetVal: %x" (Indicator: "GetProcessId"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")53:T1acd,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp") Found string "Device Lock has been triggered due to too many incorrect password attempts." (Indicator: "password"; Source: "00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp")54:T6d2,Found string "SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Indicator: "msacpi_thermalzonetemperature"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_FAN" (Indicator: " Win32_Fan"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_CACHEMEMORY" (Indicator: " Win32_CacheMemory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PHYSICALMEMORY" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYDEVICE" (Indicator: " Win32_MemoryDevice"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYARRAY" (Indicator: " Win32_MemoryArray"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_VOLTAGEPROBE" (Indicator: " Win32_VoltageProbe"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PORTCONNECTOR" (Indicator: " Win32_PortConnector"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_SMBIOSMEMORY" (Indicator: " Win32_SMBIOSMemory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: " Win32_Perf"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") Found string "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: " Win32_PerfFormattedData"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp")55:T5ff,Found registry deletion API: "NtDeleteKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp"56:T920,Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "Wow64QueryInformationThread: NtOpenProcess failed, status %x" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp")57:Taa6,Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.7669A000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.76C6C000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77332000.00000002.mdmp")58:Tc66,Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73CB1000.00000020.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetInformationFile: Called with unsupported class %x." (Indicator: "SetInformationFile"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "NtSetInformationFile: Called with unsupported class %x." (Indicator: "NtSetInformationFile"; Source: "00000000-00004780.00000000.190040.64914000.00000002.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.7547B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.761EF000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.76584000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp")59:T34e1,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.73E68000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.769BE000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAuditAccessAce" (Indicator: "AddAuditAccessAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAceEx"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddAuditAccessObjectAce" (Indicator: "AddAuditAccessObjectAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddResourceAttributeAce" (Indicator: "AddResourceAttributeAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAddScopedPolicyIDAce" (Indicator: "AddScopedPolicyIDAce"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")5a:T950,Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.75AC7000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")5b:T95c,"SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Indicator: "msacpi_thermalzonetemperature"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_FAN" (Indicator: " win32_fan"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_CACHEMEMORY" (Indicator: " win32_cachememory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_PHYSICALMEMORY" (Indicator: " win32_physicalmemory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_MEMORYDEVICE" (Indicator: " win32_memorydevice"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_MEMORYARRAY" (Indicator: " win32_memoryarray"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_VOLTAGEPROBE" (Indicator: " win32_voltageprobe"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_PORTCONNECTOR" (Indicator: " win32_portconnector"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_SMBIOSMEMORY" (Indicator: " win32_smbiosmemory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: " win32_perfformatteddata_counters_thermalzoneinformation"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_MEMORY" (Indicator: " cim_memory"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_NUMERICSENSOR" (Indicator: " cim_numericsensor"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_PHYSICALCONNECTOR" (Indicator: " cim_physicalconnector"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_SENSOR" (Indicator: " cim_sensor"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_SLOT" (Indicator: " cim_slot"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_TEMPERATURESENSOR" (Indicator: " cim_temperaturesensor"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp") "SELECT * FROM CIM_VOLTAGESENSOR" (Indicator: " cim_voltagesensor"; Source: "00000000-00004780.00000000.190040.72EC3000.00000002.mdmp")5c:T509,Found string ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp") Found string "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp")5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHdwAHd3AAAAAAAAAAAAAAB3d3d3dwAAAAAAAAAAd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3d3dwAAAAAAAHd3d3d3d3d3d3d3AAAAAAd3d3d3d3d3d3d3dwAAAAAAAHd3d3d3d3d3d3d3cAAAAAAHd3d3d3d3d3d3dwAAAAB3d3d3d3d3d3cABwAAAAAHd3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3d3AAB3B3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3cAAHd3B3d3d3d3d3d3d3d3AABwd3d3d3d3d3d3d3d3dwAAB3AHd3d3d3d3d3d3d3cAAAB3cHd3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////HD///wA//8AAH//AAAH/4AAAf8AAAH/4AAAP/AAAH+AAB3/AAAD4AAAA/gAAAPgAAAB+AAAAHAAAAHgAAAB8AAAAfAAAAAwAAAAMAAAAfAAAAHgAAABwAAAAeQAAAHAAAAB4QAAAegAAAHzAAAB+IAAP///////////w==5e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHdwAHd3AAAAAAAAAAAAAAB3d3d3dwAAAAAAAAAAd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3d3dwAAAAAAAHd3d3d3d3d3d3d3AAAAAAd3d3d3d3d3d3d3dwAAAAAAAHd3d3d3d3d3d3d3cAAAAAAHd3d3d3d3d3d3dwAAAAB3d3d3d3d3d3cABwAAAAAHd3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3d3AAB3B3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3cAAHd3B3d3d3d3d3d3d3d3AABwd3d3d3d3d3d3d3d3dwAAB3AHd3d3d3d3d3d3d3cAAAB3cHd3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////HD///wA//8AAH//AAAH/4AAAf8AAAH/4AAAP/AAAH+AAB3/AAAD4AAAA/gAAAPgAAAB+AAAAHAAAAHgAAAB8AAAAfAAAAAwAAAAMAAAAfAAAAHgAAABwAAAAeQAAAHAAAAB4QAAAegAAAHzAAAB+IAAP///////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791038044459,"unified_at":"2026-10-03T14:34:04.459Z","metadata":{"hashes":{"sha256":"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1","sha1":"a23f89036f056b967dfb6d8c8632d4e3d56d2258","md5":"10e9648c3c9c3f6985e5962cdc795f21","sha512":"6c597f9278fce6d03d3aabaace82e2c6dd3afac291b484c525aeb264f9d6a6041d415ca60bac4569ca4dcd605c741f56757323fe3e20dc6978adb703ec158d6f","ssdeep":"1536:W27ZCH13jDoPwbt7KI8tdz8eicURJ70l5Mh/shYBOTR2eENX5lY4h1jSXkJxMA9Q:UBx8iciOe18YEAt5zpBHOmAK","ssdeep_chunks":["1536:W27ZCH1","1536:27ZCH13","1536:7ZCH13j","1536:ZCH13jD","1536:CH13jDo","1536:H13jDoP","1536:13jDoPw","1536:3jDoPwb","1536:jDoPwbt","1536:DoPwbt7","1536:oPwbt7K","1536:Pwbt7KI","1536:wbt7KI8","1536:bt7KI8t","1536:t7KI8td","1536:7KI8tdz","1536:KI8tdz8","1536:I8tdz8e","1536:8tdz8ei","1536:tdz8eic","1536:dz8eicU","1536:z8eicUR","1536:8eicURJ","1536:eicURJ7","1536:icURJ70","1536:cURJ70l","1536:URJ70l5","1536:RJ70l5M","1536:J70l5Mh","1536:70l5Mh/","1536:0l5Mh/s","1536:l5Mh/sh","1536:5Mh/shY","1536:Mh/shYB","1536:h/shYBO","1536:/shYBOT","1536:shYBOTR","1536:hYBOTR2","1536:YBOTR2e","1536:BOTR2eE","1536:OTR2eEN","1536:TR2eENX","1536:R2eENX5","1536:2eENX5l","1536:eENX5lY","1536:ENX5lY4","1536:NX5lY4h","1536:X5lY4h1","1536:5lY4h1j","1536:lY4h1jS","1536:Y4h1jSX","1536:4h1jSXk","1536:h1jSXkJ","1536:1jSXkJx","1536:jSXkJxM","1536:SXkJxMA","1536:XkJxMA9","1536:kJxMA9Q","3072:W27ZCH1","3072:27ZCH13","3072:7ZCH13j","3072:ZCH13jD","3072:CH13jDo","3072:H13jDoP","3072:13jDoPw","3072:3jDoPwb","3072:jDoPwbt","3072:DoPwbt7","3072:oPwbt7K","3072:Pwbt7KI","3072:wbt7KI8","3072:bt7KI8t","3072:t7KI8td","3072:7KI8tdz","3072:KI8tdz8","3072:I8tdz8e","3072:8tdz8ei","3072:tdz8eic","3072:dz8eicU","3072:z8eicUR","3072:8eicURJ","3072:eicURJ7","3072:icURJ70","3072:cURJ70l","3072:URJ70l5","3072:RJ70l5M","3072:J70l5Mh","3072:70l5Mh/","3072:0l5Mh/s","3072:l5Mh/sh","3072:5Mh/shY","3072:Mh/shYB","3072:h/shYBO","3072:/shYBOT","3072:shYBOTR","3072:hYBOTR2","3072:YBOTR2e","3072:BOTR2eE","3072:OTR2eEN","3072:TR2eENX","3072:R2eENX5","3072:2eENX5l","3072:eENX5lY","3072:ENX5lY4","3072:NX5lY4h","3072:X5lY4h1","3072:5lY4h1j","3072:lY4h1jS","3072:Y4h1jSX","3072:4h1jSXk","3072:h1jSXkJ","3072:1jSXkJx","3072:jSXkJxM","3072:SXkJxMA","3072:XkJxMA9","3072:kJxMA9Q","1536:UBx8ici","1536:Bx8iciO","1536:x8iciOe","1536:8iciOe1","1536:iciOe18","1536:ciOe18Y","1536:iOe18YE","1536:Oe18YEA","1536:e18YEAt","1536:18YEAt5","1536:8YEAt5z","1536:YEAt5zp","1536:EAt5zpB","1536:At5zpBH","1536:t5zpBHO","1536:5zpBHOm","1536:zpBHOmA","1536:pBHOmAK"],"imphash":"cb5987421c9ba8a0e2694f1a6da3d644"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":215552,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1716128372000,"last_seen":1756540946000,"last_multi_scan":1756540946000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","smokeloader","downloader","windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":161,"suspicious_count":10,"malicious_count":3,"total":174},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.BotX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1379617","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.148146","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Fareit-10030127-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_SmokeLoader_RXE_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.148146 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HXBX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"UDS:Backdoor.Mokes.gen.pnqm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wacatac.dd!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b5da91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan.SmokeLoader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.AVI.knfdgk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AEE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/FakeAlert.VV.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealc.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.2LA.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_44.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4792843","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Midie.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Able to access mailslot-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to discover program location on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve the current system language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"file\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"file\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005028.00000000.169820.001D0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005028.00000000.169820.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005028.00000000.169820.025C4000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"file\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 46708-751-004042B5\n SetUnhandledExceptionFilter@KERNEL32.dll at 46708-294-0040903A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 46708-91-00405366\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 46708-91-00405366\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 46708-150-00405E9C\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 46708-150-00405E9C\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 46708-294-0040903A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005028)\n \"file.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fafa1a771c75ca74ffffffff0c0000004afb1a777775ca74ffffffff0c000000d4e71800040000000004000001000000e8e71800210e1d0000000000 (UID: 00000000-00005028)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"file\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumDependentServicesW\" (Indicator: \"EnumDependentServices\"; File: \"file\")\n Found reference to API \"EnumDependentServicesW\" (Indicator: \"EnumDependentServices\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"file.exe\" called \"LoadLibrary\" with a parameter msimg32.dll (UID: 00000000-00005028)\n \"file.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00005028)\n \"file.exe\" called \"LoadLibrary\" with a parameter msvcr100.dll (UID: 00000000-00005028)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"file\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"file\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"file\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"file\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"file.exe\" loaded module \"MSIMG32.DLL\" at base 73830000\n \"file.exe\" loaded module \"KERNEL32.DLL\" at base 75520000\n \"file.exe\" loaded module \"MSVCR100.DLL\" at base 73770000\n \"file.exe\" loaded module \"KERNEL32\" at base 75520000\n \"file.exe\" loaded module \"USER32\" at base 76c60000\n \"file.exe\" loaded module \"ADVAPI32\" at base 76bb0000\n \"file.exe\" loaded module \"SHELL32\" at base 75990000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75430000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"file\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file\" file has an entrypoint instructions - \"call\t0x40512a,jmp\t0x401484,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x328,mov\tdword ptr [0x423438], eax,mov\tdword ptr [0x423434], ecx,mov\tdword ptr [0x423430], edx,mov\tdword ptr [0x42342c], ebx,mov\tdword ptr [0x423428], esi,mov\tdword ptr [0x423424], edi,mov\tword ptr [0x423450], ss,mov\tword ptr [0x423444], cs,mov\tword ptr [0x423420], ds,mov\tword ptr [0x42341c], es,mov\tword ptr [0x423418], fs,mov\tword ptr [0x423414], gs,pushfd\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x1f1c65c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-u -p 5028 -s 180\" (UID: 00000000-00001240)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-u -p 5028 -s 180\" (UID: 00000000-00001240)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\Windows\\system32\\wow64log.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\msimg32.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\msvcr100.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\MSIMG32.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\MSVCR100.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CallNamedPipeA\" (Indicator: \"CallNamedPipe\"; File: \"file\")\n Found reference to API \"CallNamedPipeA\" (Indicator: \"CallNamedPipe\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"14.70.41.21\"\n \"15.98.10.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; File: \"file\")\n Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"file\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: file]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"file\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005028.00000000.169825.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"file\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"file.exe queries ProcessDebugPort (UID: 5028)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 46708-1-00401602","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 46708-1-00401602","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetProcAddress\n FindFirstFileExA\n CreateFileA\n GetCommandLineA\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FlsFree\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"FlsSetValue\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"FlsGetValue\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"FlsAlloc\" (Source: file, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcessWindowStation\" (Source: file, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationA\" (Source: file, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: file, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: file, API is part of module: USER32.DLL)\n Found string \"MessageBoxA\" (Source: file, API is part of module: USER32.DLL)\n Found string \"GlobalAlloc\" (Source: file, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"The specified compression format is unsupported.\" (Source: \"00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp\")\n Found string \"The compression operation could not be completed because a transaction is active on the file.\" (Source: \"00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004780.00000000.190040.04910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.763FC000.00000002.mdmp, 00000000-00004780.00000000.190040.76584000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"The cryptographic provider does not support HMAC.\" (Indicator: \"HMAC\"; Source: \"00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00004488]\n Process \"WerFault.exe\" [UID: 00000000-00007848]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 76628; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 75088; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to discover program location on disk (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-905","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ\" (Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")\n Found string \"SMBIOSBIOSVersion\" (Source: \"00000000-00004780.00000000.190040.72EC3000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00004780.00000000.190040.72EC3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$35","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"RtlGetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"RtlpGetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004780.00000000.190040.04910000.00000004.mdmp\")\n Found reference to API \"WMRSendMessageString\" (Indicator: \"sendmessage\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"whNtUserQuerySendMessage(1050) unsupported nt api thunk: pmsg: %x\" (Indicator: \"sendmessage\"; Source: \"00000000-00004780.00000000.190040.6489D000.00000002.mdmp\")\n Found reference to API \"FilterSendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00004780.00000000.190040.72EC3000.00000002.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.739E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004780)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004780)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004780)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"TermsrvGetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"Found reference to API \"NtSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00004780.00000000.190040.06981000.00000020.mdmp\n 00000000-00004780.00000000.190040.77341000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"ZwCreateKey\" in \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.764DF000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\"\n Found registry modification API: \"ZwCreateKeyTransacted\" in \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\"\n Found registry modification API: \"ZwCreateKeyedEvent\" in \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.72FC4000.00000002.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73E71000.00000020.mdmp, 00000000-00004780.00000000.190040.7569B000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4780:168:WilStaging_02\"\n Process 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4780:168:WilStaging_02\"\n Process 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe created mutex with name \"SM0:4780:168:WilStaging_02\"\n Process 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe created mutex with name \"Local\\SM0:4780:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"NtRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe\" queries basic process information of the \"C:\\0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe\" (UID: 4780)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"pop.\" [Source: 00000000-00004780.00000000.190040.04720000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"dd.mm\"\n Heuristic match: \"hh.mm\"\n Heuristic match: \"tt hh.mm\"\n Heuristic match: \"tt h.mm\"\n Heuristic match: \"'kl'. h.mm\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"sp.at\"\n Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"\n Pattern match: \"http://go.microsoft.com/fwlink/?linkid=228610\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=851152\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=852747\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy File","description":"YARA signature to detect high entropy file process \"00000000-00004780\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00004780\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00004780\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Guyanaese Dollar\" (Indicator: \"aes\"; Source: \"00000000-00004780.00000000.190040.04720000.00000002.mdmp\")\n Found string \"The Diffie-Hellman group is not compatible with the policy type.\" (Indicator: \"diffie-hellman\"; Source: \"00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73F26000.00000002.mdmp, 00000000-00004780.00000000.190040.757E4000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.76819000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"RtlCheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"RtlCheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"VxDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004780.00000000.190040.72EC3000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$53","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004780.00000000.190040.04910000.00000004.mdmp\")\n Found string \"\\Device\\IPT\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found string \"\\drivers\\etc\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004780.00000000.190040.64914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"whNT32NtUserCallNextHookEx: Calling hook %x\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004780.00000000.190040.6489D000.00000002.mdmp\")\n Found reference to API \"NtUserCallNextHookEx: called with invalid CBT hook type %x\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004780.00000000.190040.6489D000.00000002.mdmp\")\n Found reference to API \"NtUserCallNextHookEx: WH_SHELL called with unknown nCode.\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004780.00000000.190040.6489D000.00000002.mdmp\")\n Found reference to API \"NtUserCallNextHookEx: called with invalid hook type %x\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004780.00000000.190040.6489D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"Found reference to API \"NtLockFile\" (Indicator: \"NtLockFile\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"NtUnlockFile\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.64914000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"The range specified in NtUnlockFile was not locked.\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-473","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"RtlCheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"RtlCheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D7B000.00000002.mdmp, 00000000-00004780.00000000.190040.76AAB000.00000002.mdmp, 00000000-00004780.00000000.190040.772C8000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73E68000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004780.00000000.190040.72DC1000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.73E68000.00000002.mdmp, 00000000-00004780.00000000.190040.760FB000.00000002.mdmp, 00000000-00004780.00000000.190040.768B0000.00000002.mdmp, 00000000-00004780.00000000.190040.77121000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"NtUserSystemParametersInfo: Called with unsupported class %x.\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004780.00000000.190040.6489D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"TpCallbackReleaseMutexOnCompletion\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004780.00000000.190040.06981000.00000020.mdmp, 00000000-00004780.00000000.190040.73D2A000.00000002.mdmp, 00000000-00004780.00000000.190040.77341000.00000020.mdmp\")\n Found reference to API \"After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x.\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004780.00000000.190040.06A9C000.00000002.mdmp, 00000000-00004780.00000000.190040.77459000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"runtimebroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1\" has section name .text with entropy \"6.613681569299843\"\n \"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1\" has section name .rdata with entropy \"6.0441832980478285\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/26 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on process \"00000000-00004780\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-112","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/26 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"},{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":43,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","smokeloader","downloader","windows-server-utility","evasive"],"sample_flags":["Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"68b2b011ebfa41fd660f19d8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1","analysis_start_time":"2025-08-30T08:02:26+00:00","indicators_count":{"informative":155,"suspicious":15,"malicious":3},"tags":["Sample Crashed","TOR analysis"],"is_in_unified_schema":true},{"id":"664a0a74c96bf5b98309572a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file","analysis_start_time":"2024-05-19T14:19:32+00:00","indicators_count":{"informative":65,"suspicious":5,"malicious":1},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}],"processes":[{"pid":4780,"ppid":0,"name":"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe","command_line":"","sha256":"0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1","normalized_path":"C:\\0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1.exe","uid":"00000000-00004780","icon":"$5d"},{"pid":7848,"ppid":4780,"name":"WerFault.exe","command_line":"-u -p 4780 -s 560","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004780","uid":"00000000-00007848"},{"pid":4488,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 4780 -ip 4780","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004488","icon":"$5e"}],"all_imported_dlls":["KernelBase.dll","ntdll.dll","VxSSL32.dll","nsi.dll","msimg32.dll","lpk.dll","sspicli.dll","user32.dll","advapi32.dll","ole32.dll","oleaut32.dll","fltLib.dll","msvcr100.dll","wow64cpu.dll","msctf.dll","wow64.dll","usp10.dll","msvcrt.dll","sechost.dll","api-ms-win-core-synch-l1-2-0.dll","kernel32.dll","shlwapi.dll","wow64win.dll","gdi32.dll","rpcrt4.dll","imm32.dll","ws2_32.dll","cryptbase.dll","shell32.dll","combase.dll","cfgmgr32.dll","apphelp.dll","cryptsp.dll","windows.storage.dll","kernel.appcore.dll","ucrtbase.dll","profapi.dll","SHCore.dll","gdi32full.dll","win32u.dll","msvcp_win.dll","bcryptprimitives.dll","powrprof.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"664a0a74c96bf5b98309572a"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"name":"SM0:4780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]},{"name":"Local\\SM0:4780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68b2b011ebfa41fd660f19d8"}]}]}},"report_ids":{"sandbox_job_ids":["664a0a74c96bf5b98309572a","68b2b011ebfa41fd660f19d8"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Midie.Generic Sample 0d3928bbe9db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0d3928bbe9db…. Malware family: Midie.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1"}],["$","meta","4",{"property":"og:title","content":"Malicious Midie.Generic Sample 0d3928bbe9db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0d3928bbe9db…. Malware family: Midie.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Midie.Generic Sample 0d3928bbe9db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0d3928bbe9db…. Malware family: Midie.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]